syzbot


uvm_fault: kcov_remote_enter (4)

Status: upstream: reported on 2025/12/08 08:56
Reported-by: syzbot+a2fe1c2e473ccee55891@syzkaller.appspotmail.com
First crash: 53d, last: 52d
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: kcov_remote_enter (3) -1 1 359d 359d 0/3 auto-obsoleted due to no activity on 2025/05/07 03:11
openbsd uvm_fault: kcov_remote_enter (2) -1 2 661d 673d 0/3 auto-obsoleted due to no activity on 2024/07/08 04:34
openbsd uvm_fault: kcov_remote_enter -1 3 1040d 1158d 0/3 auto-obsoleted due to no activity on 2023/06/25 20:12

Sample crash report:
uvm_fault(0xffffffff839b9bc0, 0xffff800029f26000, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      kcov_remote_enter+0x122:        movq    $0,0(%rcx)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*164351  98475      0           0          0    0  syz-executor
kcov_remote_enter(0,ffff80002a7dc010) at kcov_remote_enter+0x122 sys/dev/kcov.c:670
timeout_run(ffffffff837aba40,ffff80002a7b9800) at timeout_run+0xc2 sys/kern/kern_timeout.c:696
softclock_process_tick_timeout(ffff80002a7b9800,0) at softclock_process_tick_timeout+0x230 sys/kern/kern_timeout.c:756
softclock(0) at softclock+0x152 sys/kern/kern_timeout.c:788
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x73d319205da0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839b9bc0, 0xffff800029f26000, 0, 2) -> e
ddb> trace
kcov_remote_enter(0,ffff80002a7dc010) at kcov_remote_enter+0x122 sys/dev/kcov.c:670
timeout_run(ffffffff837aba40,ffff80002a7b9800) at timeout_run+0xc2 sys/kern/kern_timeout.c:696
softclock_process_tick_timeout(ffff80002a7b9800,0) at softclock_process_tick_timeout+0x230 sys/kern/kern_timeout.c:756
softclock(0) at softclock+0x152 sys/kern/kern_timeout.c:788
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x73d319205da0, count: -7
ddb> show registers
rdi                       0xffffffff
rsi               0xffff800000b11c00
rbp               0xffff80003c9435e0
rbx               0xffff80002a7dc010
rdx               0xffff80002a88ba28
rcx               0xffff800029f26000
rax               0xfffffd806cb3bf00
r8                                 0
r9                                 0
r10               0x4bb7142173d97ad9
r11               0x9ffad2279df10069
r12               0xffffffff8304fc30    endtsleep
r13               0xffff80002a7b9768
r14               0xffff80002a7dc010
r15                                0
rip               0xffffffff831ff902    kcov_remote_enter+0x122
cs                               0x8
rflags                       0x10297    __ALIGN_SIZE+0xf297
rsp               0xffff80003c9435c0
ss                                 0
kcov_remote_enter+0x122:        movq    $0,0(%rcx)
ddb> show proc
PROC (syz-executor) tid=164351 pid=98475 tcnt=3 stat=onproc
    flags process=0 proc=0
    runpri=84, usrpri=85, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a7bd4d8,0xffff80002a88aaa8
    process=0xffff80002f0ecd98 user=0xffff80003c93e000, vmspace=0xfffffd807c163748
    estcpu=35, cpticks=5, pctcpu=0.0, user=4, sys=0, intr=1
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 41951  404442  13226      0  2           0                syz-executor
 41951   82895  13226      0  3   0x4000080  fsleep        syz-executor
 91758   29857   5410      0  2           0                syz-executor
 91758  209022   5410      0  3   0x4000080  fsleep        syz-executor
 30143  455741  90055      0  2           0                syz-executor
 30143  195714  90055      0  3   0x4000080  fsleep        syz-executor
 64241  459390  34952      0  2           0                syz-executor
 64241  357002  34952      0  2   0x4000000                syz-executor
 64241  114611  34952      0  2   0x4000000                syz-executor
*98475  164351  49723      0  7           0                syz-executor
 98475  322473  49723      0  2   0x4000000                syz-executor
 98475   63268  49723      0  2   0x4000000                syz-executor
 54475   45684  54846      0  2           0                syz-executor
 54475  101308  54846      0  3   0x4000080  fsleep        syz-executor
 14167  229722      0      0  3     0x14200  acct          acct
 82727  432528      0      0  3     0x14280  nfsidl        nfsio
 16332  253836      0      0  3     0x14280  nfsidl        nfsio
 42328  401198      0      0  3     0x14280  nfsidl        nfsio
 20455  138566      0      0  3     0x14280  nfsidl        nfsio
 69481  227584      0      0  3     0x14280  nfsidl        nfsio
 28404  222750      0      0  3     0x14280  nfsidl        nfsio
 43177  342726      0      0  3     0x14280  nfsidl        nfsio
 33583  354795      0      0  3     0x14280  nfsidl        nfsio
 22710  455866      0      0  3     0x14280  nfsidl        nfsio
  9464  411596      0      0  3     0x14280  nfsidl        nfsio
 44521   66868      0      0  3     0x14280  nfsidl        nfsio
 35006  520976      0      0  3     0x14280  nfsidl        nfsio
 81851  239430      0      0  3     0x14280  nfsidl        nfsio
 14661   97378      0      0  3     0x14280  nfsidl        nfsio
  1886  135484      0      0  3     0x14280  nfsidl        nfsio
 51640  108156      0      0  3     0x14280  nfsidl        nfsio
 29357  181287      0      0  3     0x14280  nfsidl        nfsio
 64952  473702      0      0  3     0x14280  nfsidl        nfsio
 25308   26010      0      0  3     0x14280  nfsidl        nfsio
 78615  207365      0      0  3     0x14280  nfsidl        nfsio
 34952  170585  21647      0  2         0x3                syz-executor
  5410  407370  21647      0  3        0x82  nanoslp       syz-executor
 70665  291447  21647      0  2         0x2                syz-executor
 49723  515977  21647      0  2         0x3                syz-executor
 13226  323226  21647      0  3        0x82  nanoslp       syz-executor
 62595  290418  21647      0  3        0x82  nanoslp       syz-executor
 54846  228618  21647      0  3        0x82  nanoslp       syz-executor
 90055  463193  21647      0  3        0x82  nanoslp       syz-executor
 21647  174301  16467      0  3        0x82  kqread        syz-executor
 16467  282060  67112      0  3    0x10008a  sigsusp       ksh
 67112  456537  99719      0  3        0x98  kqread        sshd-session
 99719  337972  17475      0  3        0x92  kqread        sshd-session
 50761  409528      1      0  3    0x100083  ttyopn        getty
 17475   46932      1      0  3        0x88  kqread        sshd
 22933  524046  29447     73  3   0x1100090  kqread        syslogd
 29447  191167      1      0  3    0x100082  sbwait        syslogd
 15062  298859      1      0  3    0x100080  kqread        resolvd
 80598   54810  92102     77  3    0x100092  kqread        dhcpleased
  7062  312121  92102     77  3    0x100092  kqread        dhcpleased
 92102  414587      1      0  3        0x80  kqread        dhcpleased
  5537  374284      0      0  3     0x14200  bored         smr
 72733  169112      0      0  2     0x14200                zerothread
 74779  430364      0      0  3     0x14200  aiodoned      aiodoned
  5435   44119      0      0  3     0x14200  syncer        update
 46876  274297      0      0  3     0x14200  cleaner       cleaner
  2874   84600      0      0  3     0x14200  reaper        reaper
 33186  351345      0      0  3     0x14200  pgdaemon      pagedaemon
 39783  493346      0      0  3     0x14200  bored         viomb
 53500  264216      0      0  3  0x40014200  acpi0         acpi0
 16211  233088      0      0  3     0x14200  bored         softnet0
 77958  505510      0      0  3     0x14200  bored         systqmp
 36518  140448      0      0  3     0x14200  bored         systq
 59318  257893      0      0  3  0x40014200  tmoslp        softclock
 98924   97878      0      0  3  0x40014200                idle0
     1   21714      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10197  11070K   11650K 166960K     14369        0
            pcb    19     16K      17K 166960K       569        0
         rtable   200     10K      11K 166960K       720        0
             pf    30     13K      20K 166960K       253        0
         ifaddr    33      6K       8K 166960K       139        0
        ifgroup    42      1K       2K 166960K       227        0
         sysctl     4      1K       9K 166960K        15        0
       counters    31     17K      18K 166960K       129        0
       ioctlops     0      0K       4K 166960K       311        0
            iov     0      0K      20K 166960K       192        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1463     92K      93K 166960K      3232        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        29        0
         VM map     2      1K       1K 166960K         2        0
            sem    27      5K       6K 166960K        78        0
        dirhash    57     10K      11K 166960K       303        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     236K 166960K      1747        0
          sigio     0      0K       0K 166960K        63        0
           proc    60     59K     100K 166960K       759        0
        subproc    72      4K       4K 166960K       108        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       277        0
       in_multi    73      5K       7K 166960K       199        0
    ether_multi     1      0K       0K 166960K        10        0
            mrt     1      0K       0K 166960K         7        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   223    996K     996K 166960K       223        0
           exec     0      0K       1K 166960K       619        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   221    143K     158K 166960K     16774        0
       UVM aobj    43     12K      12K 166960K        54        0
     pinsyscall    39     78K      93K 166960K      2914        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K       115        0
            NDP     9      0K       2K 166960K       103        0
           temp    78   8672K    8924K 166960K     77996        0
         kqueue    13     20K      34K 166960K       349        0
      SYN cache     2      8K      16K 166960K         3        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      193    0      190     2     1     1     2     0     8    0
rtentry    136      192    0      115     4     0     4     4     0     8    0
unpcb      144     1207    0     1190     8     2     6     6     0     8    5
syncache   336        8    0        8     1     1     0     1     0     8    0
tcpqe       32        8    0        8     1     1     0     1     0     8    0
tcpcb      736      399    0      392     2     1     1     2     0     8    0
arp         96       28    0       14     1     0     1     1     0     8    0
ipq         40       11    0       11     1     0     1     1     0     8    1
ipqe        40       26    0       26     1     0     1     1     0     8    1
inpcb      328     1617    0     1604     7     5     2     7     0     8    0
ip6q        72       29    0       27     1     0     1     1     0     8    0
ip6af       40       57    0       55     1     0     1     1     0     8    0
nd6        112       48    0       32     1     0     1     1     0     8    0
pkpcb       40        8    0        8     2     1     1     1     0     8    1
kcovpl      48       12    0        4     1     0     1     1     0     8    0
mppekey    1024       2    0        2     2     1     1     1     0     8    1
ppxss      1072      80    0       80     2     1     1     1     0     8    1
pppxif     1384       7    0        7     1     1     0     1     0     8    0
pfrktable  1344       5    0        5     2     1     1     1     0     8    1
pfanchor   1288       4    0        1     1     0     1     1     0     8    0
pfstitem    24        6    0        0     1     0     1     1     0     8    0
pfstkey    128        9    0        4     1     0     1     1     0     8    0
pfstate    384        5    0        2     1     0     1     1     0     8    0
pfrule     1344       4    0        4     1     1     0     1     0     8    0
rttmr      136        1    0        1     1     0     1     1     0     8    1
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      845    0      499    30     3    27    30     0     8    1
art_table   40      848    0      499     5     0     5     5     0     8    0
art_node    32      190    0      121     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        2     1     0     1     1     0     8    0
semupl     112        2    0        2     1     1     0     1     0     8    0
semapl     112       70    0       45     1     0     1     1     0     8    0
shmpl      112       43    0        8     1     0     1     1     0     8    0
dirhash    1024     119    0       87     5     0     5     5     0     8    0
dino2pl    256     4652    0     3152    95     0    95    95     0     8    0
ffsino     256     4652    0     3152    95     0    95    95     0     8    0
nchpl      144     7113    0     5415    64     0    64    64     0     8    0
rtmask      32       14    0       14     2     1     1     1     0     8    1
vnodes     216     5897    0        0   328     0   328   328     0     8    0
namei      1024   25040    0    25039     3     2     1     2     0     8    0
vcpupl     3904       5    0        0     1     0     1     1     0     8    0
vmpool     800        8    0        3     1     0     1     1     0     8    0
kstatmem   264      156    0      138     2     0     2     2     0     8    0
acpiwqpl    32        2    0        2     1     0     1     1     1     8    1
scsiplug    72        6    0        6     2     1     1     1     0     8    1
scxspl     216    25430    0    25430    15     7     8     8     1     8    8
plimitpl   152      573    0      556     1     0     1     1     0     8    0
sigapl     424     2054    0     1990    10     2     8    10     0     8    0
knotepl    120    85080    0    85033    43    33    10    17     0     8    8
kqueuepl   184      955    0      946     6     5     1     6     0     8    0
pipepl     304      236    0      209     3     0     3     3     0     8    0
fdescpl    448     1995    0     1965     5     1     4     5     0     8    0
filepl     120    13693    0    13475    14     3    11    13     0     8    2
lockfpl    104      635    0      631     1     0     1     1     0     8    0
lockfspl    48      251    0      247     1     0     1     1     0     8    0
sessionpl  144       28    0       20     1     0     1     1     0     8    0
pgrppl      48      183    0      167     1     0     1     1     0     8    0
ucredpl    104     2432    0     2420     1     0     1     1     0     8    0
zombiepl   144     2230    0     2228     2     1     1     1     0     8    0
processpl  1152    2054    0     1990     6     1     5     6     0     8    0
procpl     664     4461    0     4388     8     0     8     8     0     8    1
sosppl     176       19    0       19     2     1     1     1     0     8    1
sockpl     552     3151    0     3118    19     9    10    12     0     8    7
mcl64k     65536    161    0      161     1     0     1     1     0     8    1
mcl16k     16384      3    0        3     1     1     0     1     0     8    0
mcl12k     12288      2    0        2     1     1     0     1     0     8    0
mcl8k      8192      20    0       20     2     1     1     1     0     8    1
mcl4k      4096    4626    0     4575    14     6     8    13     0     8    1
mcl2k2     2112       2    0        2     2     1     1     1     0     8    1
mcl2k      2048    2636    0     2628    13    10     3    13     0     8    1
mtagpl      96      195    0       89     3     0     3     3     0     8    0
mbufpl     256    23801    0    23587    80    61    19    79     0     8    0
bufpl      280    10079    0     3858   445     0   445   445     0     8    0
anonpl      24   313012    0   309902    95    50    45    88     0   187   12
amapchunkpl 152   59094    0    58643    35     9    26    31     0   158    6
amappl16   200     6246    0     6210    55    40    15    27     0     8    7
amappl15   192       19    0       19     2     1     1     1     0     8    1
amappl14   184        2    0        2     1     1     0     1     0     8    0
amappl13   176      454    0      453     1     0     1     1     0     8    0
amappl12   168     2372    0     2334     2     0     2     2     0     8    0
amappl11   160        6    0        6     1     1     0     1     0     8    0
amappl10   152       46    0       36     1     0     1     1     0     8    0
amappl9    144      278    0      278     1     1     0     1     0     8    0
amappl8    136       40    0       39     1     0     1     1     0     8    0
amappl7    128      120    0      119     1     0     1     1     0     8    0
amappl6    120      317    0      306     1     0     1     1     0     8    0
amappl5    112       87    0       79     1     0     1     1     0     8    0
amappl4    104      411    0      385     1     0     1     1     0     8    0
amappl3     96    11728    0    11628     4     0     4     4     0     8    0
amappl2     88      585    0      528     2     0     2     2     0     8    0
amappl1     80    16673    0    16143    13     1    12    13     0     8    0
amappl      88    15711    0    15557     5     0     5     5     0    92    0
uvmvnodes   80      158    0        0     4     0     4     4     0     8    0
dma4096    4096       2    0        2     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        8    0        8     2     1     1     1     0     8    1
dma128     128      256    0      256     1     1     0     1     0     8    0
dma64       64        7    0        7     1     1     0     1     0     8    0
dma32       32        9    0        9     2     1     1     1     0     8    1
dma16       16       20    0       19     1     0     1     1     0     8    0
aobjpl      72       53    0       11     1     0     1     1     0     8    0
uaddrrnd    24     1995    0     1965     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1995    0     1965     1     0     1     1     0     8    0
vmmpekpl   168    16006    0    15967     3     0     3     3     0     8    0
vmmpepl    168   129911    0   128112   102    10    92   101     0   357   12
vmsppl     368     1994    0     1965     4     1     3     4     0     8    0
rwobjpl     40    34499    0    33468    16     2    14    16     0     8    0
pdppl      4096    4013    0     3941   121    49    72    79     0     8    0
pvpl        32   889065    0   880634   177    63   114   175     0   265   14
pmappl     216     2002    0     1968     2     0     2     2     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      481    0      140    12     0    12    12     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
kcov_remote_enter(0,ffff80002a7dc010) at kcov_remote_enter+0x122 sys/dev/kcov.c:670
timeout_run(ffffffff837aba40,ffff80002a7b9800) at timeout_run+0xc2 sys/kern/kern_timeout.c:696
softclock_process_tick_timeout(ffff80002a7b9800,0) at softclock_process_tick_timeout+0x230 sys/kern/kern_timeout.c:756
softclock(0) at softclock+0x152 sys/kern/kern_timeout.c:788
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x73d319205da0, count: -7
ddb> machine ddbcpu 1
No such command
ddb> trace
kcov_remote_enter(0,ffff80002a7dc010) at kcov_remote_enter+0x122 sys/dev/kcov.c:670
timeout_run(ffffffff837aba40,ffff80002a7b9800) at timeout_run+0xc2 sys/kern/kern_timeout.c:696
softclock_process_tick_timeout(ffff80002a7b9800,0) at softclock_process_tick_timeout+0x230 sys/kern/kern_timeout.c:756
softclock(0) at softclock+0x152 sys/kern/kern_timeout.c:788
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
end of kernel
end trace frame: 0x73d319205da0, count: -7

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/09 14:17 openbsd bf8f637750de fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
2025/12/09 07:28 openbsd bf8f637750de fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
2025/12/09 07:24 openbsd bf8f637750de fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
2025/12/09 05:56 openbsd bf8f637750de fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
2025/12/08 19:14 openbsd c5b72cc0187d fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
2025/12/08 15:45 openbsd c5b72cc0187d fc20f974 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
2025/12/08 08:55 openbsd c5b72cc0187d cee4cb10 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: kcov_remote_enter
* Struck through repros no longer work on HEAD.