uvm_fault: in_pcbhash_insert

Status: upstream: reported on 2026/07/21 02:01
Reported-by: syzbot+a52c5bdbd489896eb29b@syzkaller.appspotmail.com
First crash: 60d, last: 10d

Sample crash report:
uvm_fault(0xffffef806cf1ab88, 0x44, 0, 2) -> e
fatal page fault in supervisor mode
trap type 6 code 2 rip ffffffff826f4c39 cs 8 rflags 10246 cr2 44 cpl 9 rsp ffff80003c411d00
gsbase 0xffffffff83934ff0  kgsbase 0x0
panic: trap type 6, code=2, pc=ffffffff826f4c39
Starting stack trace...
panic(ffffffff834f0256) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff80003c411c50) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
in_pcbhash_insert(ffffef800d33ca50) at in_pcbhash_insert+0x159 sys/netinet/in_pcb.c:1096
in_pcballoc(ffff8000015acc60,ffffffff83af89d8,1) at in_pcballoc+0x24c sys/netinet/in_pcb.c:269
rip_attach(ffff8000015acc60,1,1) at rip_attach+0x117 sys/netinet/raw_ip.c:489
socreate(2,ffff80003c411ef0,3,1) at socreate+0x238 pru_attach sys/sys/protosw.h:275 [inline]
socreate(2,ffff80003c411ef0,3,1) at socreate+0x238 sys/kern/uipc_socket.c:220
sys_socket(ffff80002a22b4d8,ffff80003c412040,ffff80003c411f90) at sys_socket+0x124 sys/kern/uipc_syscalls.c:102
syscall(ffff80003c412040) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c412040) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8970f523bd0, count: 247
End of stack trace.
WARNING: SPL NOT LOWERED ON SYSCALL 83 334415616 EXIT 0 9
Stopped at      savectx+0xae:   movl    $0,%gs:0x688
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 31673  20952      0           0          0    0  syz-executor
savectx() at savectx+0xae
end of kernel
end trace frame: 0x7f230a9cda70, count: 14
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> 

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/08 15:05 openbsd 90a01398013e 351387c4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: in_pcbhash_insert
2026/08/26 18:37 openbsd 9c51b1274871 a2b77b9e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: in_pcbhash_insert
2026/08/22 23:02 openbsd 37e4cd13f45d 1e72964b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: in_pcbhash_insert
2026/08/15 14:01 openbsd b903a0834f41 746171ee .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: in_pcbhash_insert
2026/08/02 13:18 openbsd f8480ad0276a e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: in_pcbhash_insert
2026/07/22 12:52 openbsd 9107f2bc3d03 4a865b71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: in_pcbhash_insert
2026/07/21 02:01 openbsd d55fd7dd01df de6a700d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: in_pcbhash_insert
* Struck through repros no longer work on HEAD.