syzbot


uvm_fault: alltraps_kern_meltdown

Status: upstream: reported on 2025/08/10 20:55
Reported-by: syzbot+a3a7ecde40e4e2e41825@syzkaller.appspotmail.com
First crash: 70d, last: 11d

Sample crash report:
uvm_fault(0xfffffd8066e2ad88, 0x0, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff832d2c88 cs 8 rflags 10207 cr2 0 cpl 0 rsp ffff8000317d6610
gsbase 0xffff8000299edff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff832d2c88
Starting stack trace...
panic(ffffffff833b8594) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff8000317d6560) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
dt_ioctl_record_stop(ffff80000149e000) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(21e5f,81,2000,ffff80003c504a98) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(21e5f,81,2000,ffff80003c504a98) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff8000317d6710) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd805b5f1490,81,fffffd80097fb3a8,ffff80003c504a98) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806c23d678,ffff80003c504a98) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline]
vn_closefile(fffffd806c23d678,ffff80003c504a98) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615
fdrop(fffffd806c23d678,ffff80003c504a98) at fdrop+0x121 sys/kern/kern_descrip.c:1280
closef(fffffd806c23d678,ffff80003c504a98) at closef+0x192 sys/kern/kern_descrip.c:1264
fdfree(ffff80003c504a98) at fdfree+0x116 sys/kern/kern_descrip.c:1195
exit1(ffff80003c504a98,0,0,1) at exit1+0x576 sys/kern/kern_exit.c:215
sys_exit(ffff80003c504a98,ffff8000317d6a80,ffff8000317d69d0) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff8000317d6a80) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff8000317d6a80) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7c2262404d10, count: 242
End of stack trace.
WARNING: SPL NOT LOWERED ON TRAP EXIT 4 0
Stopped at      alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*414832  57461      0           0  0x4000000    1K syz-executor
 194420  26774  60929        0x10  0x4000000    0  syz-executor
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copystr_fault() at copystr_fault
namei(ffff80003c429700) at namei+0x190 sys/kern/vfs_lookup.c:156
vn_open(ffff80003c429700,11,0) at vn_open+0x15a sys/kern/vfs_vnops.c:140
doopenat(ffff80002a2be2b0,ffffff9c,200000000080,10,0,ffff80003c4298b0) at doopenat+0x35b sys/kern/vfs_syscalls.c:1138
syscall(ffff80003c429960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c429960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x719cf5fb220, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffffd8066e2ad88, 0x0, 0, 1) -> e
ddb{1}> trace
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copystr_fault() at copystr_fault
namei(ffff80003c429700) at namei+0x190 sys/kern/vfs_lookup.c:156
vn_open(ffff80003c429700,11,0) at vn_open+0x15a sys/kern/vfs_vnops.c:140
doopenat(ffff80002a2be2b0,ffffff9c,200000000080,10,0,ffff80003c4298b0) at doopenat+0x35b sys/kern/vfs_syscalls.c:1138
syscall(ffff80003c429960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c429960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x719cf5fb220, count: -7
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80003c4293c0
rbx                                0
rdx                                0
rcx               0xffff80002a2be2b0
rax                             0x2a
r8                0xffff80003c4292f0
r9                               0x1
r10               0xd50863e843581b56
r11               0x4b61a1b57a5ffacc
r12               0xffff80002a263800
r13               0xffff80003c429740
r14                            0x400
r15                   0x200000000080
rip               0xffffffff832f020b    alltraps_kern_meltdown+0xb8
cs                               0x8
rflags                         0x246
rsp               0xffff80003c429340
ss                              0x10
alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
ddb{1}> show proc
PROC (syz-executor) tid=414832 pid=57461 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=36, usrpri=86, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a2bf770,0xffff80002a2bfa18
    process=0xffff8000fffece88 user=0xffff80003c424000, vmspace=0xfffffd8066e2a9b8
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 57461  453303  25646      0  2           0                syz-executor
 57461  128276  25646      0  3   0x4000080  fsleep        syz-executor
*57461  414832  25646      0  7   0x4000000                syz-executor
 57461   99887  25646      0  3   0x4000080  fsleep        syz-executor
 26774   66004  42372  60929  3        0x90  nanoslp       syz-executor
 26774  194420  42372  60929  7   0x4000010                syz-executor
 26774  138130  42372  60929  3   0x4000090  fsleep        syz-executor
 26774  288682  42372  60929  2   0x4000010                syz-executor
 85450  112949  50932      0  2           0                syz-executor
 85450  114884  50932      0  3   0x4000080  fsleep        syz-executor
 20339  232019  61603      0  2           0                syz-executor
 20339  500733  61603      0  2   0x4000000                syz-executor
 20339  227811  61603      0  3   0x4000080  fsleep        syz-executor
 47532  183890      0      0  3     0x14280  nfsidl        nfsio
 49401  362198  17379      0  2  0x10000082                syz-executor
 61603  182899  17379      0  3        0x82  nanoslp       syz-executor
 27138  408747  17379      0  3        0x82  nanoslp       syz-executor
 25646  408878  17379      0  3        0x82  nanoslp       syz-executor
 91642  204181      1      0  3    0x100083  ttyopn        getty
 82827  269134      0      0  3     0x14200  acct          acct
 92056  139650  17379      0  2         0x2                syz-executor
 42372  435652  17379      0  3        0x82  nanoslp       syz-executor
 12126   56339      0      0  3     0x14200  bored         sosplice
 50932  289145  17379      0  3        0x82  nanoslp       syz-executor
  5876  299407  17379      0  3        0x82  nanoslp       syz-executor
 17379   16522  42936      0  3        0x82  kqread        syz-executor
 42936  174560  15756      0  3    0x10008a  sigsusp       ksh
 15756  269811  64539      0  3        0x98  kqread        sshd-session
 64539  498780  69500      0  3        0x92  kqread        sshd-session
 69500  370486      1      0  3        0x88  kqread        sshd
 34081   31358  90871     74  3   0x1100092  bpf           pflogd
 90871  374122      1      0  3        0x80  sbwait        pflogd
 55833  163495  18966     73  3   0x1100090  kqread        syslogd
 18966  413286      1      0  3    0x100082  sbwait        syslogd
 63043  233043      1      0  3    0x100080  kqread        resolvd
 39305  279895  48324     77  3    0x100092  kqread        dhcpleased
 63755  397333  48324     77  3    0x100092  kqread        dhcpleased
 48324    8135      1      0  3        0x80  kqread        dhcpleased
 18392  499183      0      0  3     0x14200  bored         smr
 80520   47474      0      0  2     0x14200                zerothread
 40899  307860      0      0  3     0x14200  aiodoned      aiodoned
 63120   89241      0      0  3     0x14200  syncer        update
 70410   15752      0      0  3     0x14200  cleaner       cleaner
 42810  192370      0      0  3     0x14200  reaper        reaper
  8096  145906      0      0  3     0x14200  pgdaemon      pagedaemon
 87903  407492      0      0  3     0x14200  bored         viomb
 89971  352973      0      0  3  0x40014200  acpi0         acpi0
  3284  149816      0      0  3  0x40014200                idle1
 19196  451602      0      0  3     0x14200  bored         softnet1
 98995  257468      0      0  2     0x14200                softnet0
  2783  417134      0      0  2  0x40014200                systqmp
 30161  123469      0      0  3     0x14200  bored         systq
 37238   52978      0      0  3     0x14200  tmoslp        softclockmp
 66025  250589      0      0  3  0x40014200  tmoslp        softclock
 68995  518729      0      0  3  0x40014200                idle0
     1   33798      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 26774 (syz-executor) thread 0xffff80003c3fcd20 (194420)
Process 26774 (syz-executor) thread 0xffff80002a2bfca0 (288682)
Process 92056 (syz-executor) thread 0xffff8000fffeb4e0 (139650)
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10249  11133K   11725K 166960K     13335        0
            pcb    18     16K      22K 166960K       469        0
         rtable   242     11K      12K 166960K      1227        0
             pf    36     18K   67487K 166960K       285        0
         ifaddr    40      7K       8K 166960K       176        0
        ifgroup    51      2K       2K 166960K       271        0
         sysctl     4      1K       9K 166960K        23        0
       counters    66     36K      37K 166960K       288        0
       ioctlops     0      0K       5K 166960K      1961        0
            iov     0      0K      24K 166960K       162        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1485     93K      94K 166960K      3156        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3    620K     628K 166960K        43        0
         VM map     2      1K       1K 166960K         2        0
            sem    18     32K      32K 166960K        75        0
        dirhash    12      2K       3K 166960K        96        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K     236K 166960K      2415        0
          sigio     0      0K       0K 166960K       175        0
           proc    73    131K     180K 166960K      1007        0
        subproc    72      4K       4K 166960K       144        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     1      0K       0K 166960K       610        0
       in_multi    92      6K       7K 166960K       319        0
    ether_multi     3      0K       0K 166960K        43        0
            mrt     2      0K       0K 166960K        22        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   247   1102K    1102K 166960K       247        0
           exec     0      0K       1K 166960K      1015        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   246    176K     204K 166960K     23799        0
       UVM aobj    66      3K       3K 166960K        73        0
     pinsyscall    41     82K     103K 166960K      3776        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       1K 166960K       244        0
            NDP    11      0K       2K 166960K       117        0
           temp    78   8656K    8906K 166960K    128073        0
         kqueue    13     20K      34K 166960K       503        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      508    0      504     6     5     1     3     0     8    0
rtentry    176      365    0      266     6     0     6     6     0     8    0
unpcb      144     1658    0     1640    15    14     1     6     0     8    0
syncache   336       16    0       16     5     5     0     1     0     8    0
tcpqe       32       11    0       11     2     2     0     1     0     8    0
tcpcb      736      779    0      771    13    12     1     7     0     8    0
arp        136       79    0       57     1     0     1     1     0     8    0
inpcb      328     2736    0     2723    39    34     5    12     0     8    3
nd6        152       55    0       29     2     0     2     2     0     8    0
pkpcb       40       85    0       83     8     7     1     1     0     8    0
kcovpl      48       16    0        8     1     0     1     1     0     8    0
mppekey    1024       2    0        2     2     2     0     1     0     8    0
ppxss      1192      83    0       83     7     7     0     1     0     8    0
pppxif     1504      10    0       10     4     4     0     1     0     8    0
pfstscr     40        5    0        4     1     0     1     1     0     8    0
pffrag     232       38    0       30     1     0     1     1     0   482    0
pffrnode    88       18    0       11     1     0     1     1     0     8    0
pffrent     40       68    0       60     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       7    0        7     1     1     0     1     0     8    0
pfanchor   1288       6    0        1     1     0     1     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfstitem    24      214    0      132     1     0     1     1     0     8    0
pfstkey    128      220    0      139     4     0     4     4     0     8    0
pfstate    384      216    0      136    11     0    11    11     0     8    0
pfrule     1344      34    0       29     2     1     1     2     0     8    0
rttmr      136        4    0        4     3     3     0     1     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256     1423    0     1058    47    16    31    33     0     8    6
art_table   40     1426    0     1058     6     0     6     6     0     8    0
art_node    32      361    0      278     2     0     2     2     0     8    0
sysvmsgpl   40       11    0        8     2     1     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       70    0       54     1     0     1     1     0     8    0
shmpl      112       70    0        7     2     0     2     2     0     8    0
dirhash    1024      75    0       58     3     0     3     3     0     8    0
dino2pl    256     6020    0     4495    97     1    96    96     0     8    0
ffsino     296     6020    0     4495   119     1   118   118     0     8    0
nchpl      144     9348    0     8758    65    39    26    65     0     8    0
rtmask      32       13    0       13     6     6     0     1     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   34775    0    34773     7     6     1     2     0     8    0
percpumem   16      159    0      111     1     0     1     1     0     8    0
pfiaddrpl  120        2    0        2     1     1     0     1     0     8    0
kstatmem   264      172    0      148     5     3     2     3     0     8    0
scsiplug    72       11    0       11     8     7     1     1     0     8    1
scxspl     216    81471    0    81471    13    12     1     8     1     8    1
plimitpl   152      820    0      800     1     0     1     1     0     8    0
sigapl     424     2725    0     2675     9     2     7     8     0     8    0
knotepl    120      822    0        0    25     0    25    25     0     8    0
kqueuepl   224     1140    0     1065    21    16     5     5     0     8    0
pipepl     344      559    0      531    17    14     3     9     0     8    0
fdescpl    528     2681    0     2651     3     0     3     3     0     8    0
filepl     160    19271    0    18975    35    20    15    21     0     8    1
lockfpl    104      774    0      770     2     1     1     2     0     8    0
lockfspl    48      338    0      334     1     0     1     1     0     8    0
sessionpl  144       40    0       31     1     0     1     1     0     8    0
pgrppl      48       77    0       60     1     0     1     1     0     8    0
ucredpl    104     2707    0     2693     1     0     1     1     0     8    0
zombiepl   144     3611    0     3608     3     2     1     1     0     8    0
processpl  1232    2725    0     2675     7     2     5     6     0     8    0
procpl     664     6608    0     6549     8     1     7     8     0     8    0
sosppl     168       12    0       12     6     5     1     1     0     8    1
sockpl     752     5195    0     5158    75    65    10    20     0     8    6
mcl64k     65536      5    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     138    0        0    16     0    16    16     0     8    0
mcl2k      2048      98    0        0     7     0     7     7     0     8    0
mtagpl      96        4    0        0     1     0     1     1     0     8    0
mbufpl     256     1210    0        0    74     0    74    74     0     8    0
bufpl      280    34544    0    28407   439     0   439   439     0     8    0
anonpl      32    14415    0        0   117     0   117   117     0   246    0
amapchunkpl 152   82110    0    81635    66    42    24    39     0   158    1
amappl16   200    11113    0    11078    66    56    10    30     0     8    0
amappl15   192       10    0        8     1     0     1     1     0     8    0
amappl14   184        3    0        3     1     1     0     1     0     8    0
amappl13   176      519    0      517     1     0     1     1     0     8    0
amappl12   168     3117    0     3076     3     0     3     3     0     8    0
amappl11   160        6    0        6     1     1     0     1     0     8    0
amappl10   152       52    0       38     1     0     1     1     0     8    0
amappl9    144      255    0      255     2     2     0     1     0     8    0
amappl8    136       32    0       30     1     0     1     1     0     8    0
amappl7    128      112    0      110     1     0     1     1     0     8    0
amappl6    120      384    0      370     1     0     1     1     0     8    0
amappl5    112       85    0       74     1     0     1     1     0     8    0
amappl4    104      500    0      469     1     0     1     1     0     8    0
amappl3     96    14745    0    14655     3     0     3     3     0     8    0
amappl2     88     2831    0     2755     2     0     2     2     0     8    0
amappl1     80    21177    0    20582    16     3    13    15     0     8    0
amappl      88    22459    0    22296     5     0     5     5     0    92    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
dma65536   65536      1    0        1     1     1     0     1     0     8    0
dma16384   16384      2    0        2     2     2     0     1     0     8    0
dma8192    8192       1    0        1     1     1     0     1     0     8    0
dma4096    4096       2    0        2     2     2     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256       10    0       10     3     3     0     1     0     8    0
dma128     128      257    0      257     4     4     0     1     0     8    0
dma64       64        7    0        7     2     2     0     1     0     8    0
dma32       32        9    0        9     2     2     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       72    0        7     2     0     2     2     0     8    0
uaddrrnd    24     2681    0     2651     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2681    0     2651     1     0     1     1     0     8    0
vmmpekpl   168    22929    0    22870     4     0     4     4     0     8    0
vmmpepl    168   180155    0   178253   133    37    96   112     0   357    1
vmsppl     488     2680    0     2651     7     2     5     5     0     8    0
rwobjpl     80    56227    0    49292   151     5   146   151     0     8    0
pdppl      4096    5370    0     5302   147    75    72    86     0     8    4
pvpl        32    24993    0        0   202     0   202   202     0   265    0
pmappl     256     2680    0     2651     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      437    0      126     9     0     9     9     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83868ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 sys/kern/kern_lock.c:165
softintr_dispatch(2) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(2) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
Xsofttty() at Xsofttty+0x27
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 sys/kern/kern_lock.c:165
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x2e kd_curproc sys/dev/kcov.c:584 [inline]
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x2e sys/dev/kcov.c:230
uvm_map_lookup_entry(fffffd8066e2a030,18000,ffff80002a304238) at uvm_map_lookup_entry+0x218 sys/uvm/uvm_map.c:1566
uvmfault_lookup(ffff80002a304210,0) at uvmfault_lookup+0x133 sys/uvm/uvm_fault.c:1902
end trace frame: 0xffff80002a304100, count: 0
ddb{0}> trace
x86_ipi_db(ffffffff83868ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 sys/kern/kern_lock.c:165
softintr_dispatch(2) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(2) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
Xsofttty() at Xsofttty+0x27
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff8394b8b0) at __mp_lock+0x192 sys/kern/kern_lock.c:165
softintr_dispatch(0) at softintr_dispatch+0x125 sys/kern/kern_softintr.c:83
dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:847
Xsoftclock() at Xsoftclock+0x27
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x2e kd_curproc sys/dev/kcov.c:584 [inline]
__sanitizer_cov_trace_const_cmp4(0,0) at __sanitizer_cov_trace_const_cmp4+0x2e sys/dev/kcov.c:230
uvm_map_lookup_entry(fffffd8066e2a030,18000,ffff80002a304238) at uvm_map_lookup_entry+0x218 sys/uvm/uvm_map.c:1566
uvmfault_lookup(ffff80002a304210,0) at uvmfault_lookup+0x133 sys/uvm/uvm_fault.c:1902
uvm_fault_check(ffff80002a304210,ffff80002a304248,ffff80002a304280,0) at uvm_fault_check+0x4f sys/uvm/uvm_fault.c:699
uvm_fault(fffffd8066e2a030,18000,0,2) at uvm_fault+0x106 sys/uvm/uvm_fault.c:633
kpageflttrap(ffff80002a3043c0,18020) at kpageflttrap+0x2f4 sys/arch/amd64/amd64/trap.c:283
kerntrap(ffff80002a3043c0) at kerntrap+0x198 sys/arch/amd64/amd64/trap.c:491
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
copyout() at copyout+0x64
syscall(ffff80002a304800) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a304800) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe1c62cbec20, count: -22
ddb{0}> machine ddbcpu 1
Stopped at      alltraps_kern_meltdown+0xb8:    movl    %ebx,%gs:0x688
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copystr_fault() at copystr_fault
namei(ffff80003c429700) at namei+0x190 sys/kern/vfs_lookup.c:156
vn_open(ffff80003c429700,11,0) at vn_open+0x15a sys/kern/vfs_vnops.c:140
doopenat(ffff80002a2be2b0,ffffff9c,200000000080,10,0,ffff80003c4298b0) at doopenat+0x35b sys/kern/vfs_syscalls.c:1138
syscall(ffff80003c429960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c429960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x719cf5fb220, count: 8
ddb{1}> trace
alltraps_kern_meltdown() at alltraps_kern_meltdown+0xb8
copystr_fault() at copystr_fault
namei(ffff80003c429700) at namei+0x190 sys/kern/vfs_lookup.c:156
vn_open(ffff80003c429700,11,0) at vn_open+0x15a sys/kern/vfs_vnops.c:140
doopenat(ffff80002a2be2b0,ffffff9c,200000000080,10,0,ffff80003c4298b0) at doopenat+0x35b sys/kern/vfs_syscalls.c:1138
syscall(ffff80003c429960) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c429960) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x719cf5fb220, count: -7

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/09 03:26 openbsd 42468faed836 7e2882b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
2025/08/10 20:54 openbsd 9abff0b24f7a 32a0e5ed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: alltraps_kern_meltdown
* Struck through repros no longer work on HEAD.