syzbot
uvm_fault: in_pcbhash_insert
Status:
upstream: reported on 2026/07/21 02:01
Reported-by: syzbot+a52c5bdbd489896eb29b@syzkaller.appspotmail.com
First crash: 60d, last: 10d
Sample crash report:
uvm_fault(0xffffef806cf1ab88, 0x44, 0, 2) -> e
fatal page fault in supervisor mode
trap type 6 code 2 rip ffffffff826f4c39 cs 8 rflags 10246 cr2 44 cpl 9 rsp ffff80003c411d00
gsbase 0xffffffff83934ff0 kgsbase 0x0
panic: trap type 6, code=2, pc=ffffffff826f4c39
Starting stack trace...
panic(ffffffff834f0256) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff80003c411c50) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
in_pcbhash_insert(ffffef800d33ca50) at in_pcbhash_insert+0x159 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff8000015acc60,ffffffff83af89d8,1) at in_pcballoc+0x24c sys/netinet/in_pcb.c:269
rip_attach(ffff8000015acc60,1,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff80003c411ef0,3,1) at socreate+0x238 pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff80003c411ef0,3,1) at socreate+0x238 sys/kern/uipc_socket.c:220
sys_socket(ffff80002a22b4d8,ffff80003c412040,ffff80003c411f90) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff80003c412040) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c412040) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8970f523bd0, count: 247
End of stack trace.
WARNING: SPL NOT LOWERED ON SYSCALL 83 334415616 EXIT 0 9
Stopped at savectx+0xae: movl $0,%gs:0x688
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 31673 20952 0 0 0 0 syz-executor
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f230a9cda70, count: 14
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{0}>
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}>
* Struck through repros no longer work on HEAD.