syzbot


uvm_fault: savectx (3)

Status: upstream: reported on 2025/02/20 07:12
Reported-by: syzbot+a67c3d29b86efeb5eed6@syzkaller.appspotmail.com
First crash: 427d, last: 1h05m
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: savectx -1 1 1245d 1245d 0/3 auto-obsoleted due to no activity on 2023/02/23 10:19
openbsd uvm_fault: savectx (2) -1 33 549d 637d 0/3 auto-obsoleted due to no activity on 2024/12/10 09:14

Sample crash report:
login: uvm_fault(0xfffffd8078f0c3d8, 0x98, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff828aa368 cs 8 rflags 10246 cr2 98 cpl 0 rsp ffff800037fad9f0
gsbase 0xffff8000299adff0  kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff828aa368
Starting stack trace...
panic(ffffffff834812fb) at panic+0x1d0 sys/kern/subr_prf.c:229
kerntrap(ffff800037fad940) at kerntrap+0x30b
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
dovutimens(ffff8000fffefca0,fffffd8067a9aeb0,ffff800037fadb20) at dovutimens+0x368 sys/kern/vfs_syscalls.c:2771
sys_futimes(ffff8000fffefca0,ffff800037fadc70,ffff800037fadbc0) at sys_futimes+0x208 sys/kern/vfs_syscalls.c:2813
syscall(ffff800037fadc70) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800037fadc70) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xe681c4df40, count: 250
End of stack trace.
WARNING: SPL NOT LOWERED ON SYSCALL 12 1884056480 EXIT 0 4
Stopped at      savectx+0xae:   movl    $0,%gs:0x688
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*125269  86069      0           0          0    1  syz-executor
 233713  19265      0           0          0    0  syz-executor
savectx() at savectx+0xae
end of kernel
end trace frame: 0x720e704c6c40, count: 14
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffffd8078f0c3d8, 0x98, 0, 1) -> e
ddb{1}> trace
savectx() at savectx+0xae
end of kernel
end trace frame: 0x720e704c6c40, count: -1
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80003bbc11e0
rbx                                0
rdx                                0
rcx               0xffff8000fffeed10
rax                             0x3b
r8                0xffff80003bbc1110
r9                               0x1
r10               0x425f241683362076
r11               0x54915a1e38a3893b
r12                                0
r13                                0
r14               0xffff8000fffeed10
r15                                0
rip               0xffffffff819633ee    savectx+0xae
cs                               0x8
rflags                          0x46
rsp               0xffff80003bbc1160
ss                              0x10
savectx+0xae:   movl    $0,%gs:0x688
ddb{1}> show proc
PROC (syz-executor) tid=125269 pid=86069 tcnt=1 stat=onproc
    flags process=0 proc=0
    runpri=50, usrpri=50, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000fffefca0,0xffffffff83a05250
    process=0xffff80002a38eb68 user=0xffff80003bbbc000, vmspace=0xfffffd8078f0cd60
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
*86069  125269  66178      0  7           0                syz-executor
 19265  233713  26610      0  7           0                syz-executor
 19265  251308  26610      0  3   0x4000000  sbar          syz-executor
 13570  268881  69132      0  2    0x100002                sh
 13026  243400  87137      0  2           0                syz-executor
 13026  206996  87137      0  3   0x4000080  fsleep        syz-executor
 64706  481078  88880      0  2           0                syz-executor
 98200  355737  10814      0  2           0                syz-executor
 69132  376207  40540      0  3        0x82  wait          syz-executor
  9229  519416      1      0  3    0x100083  ttyin         getty
 76895  341610      0      0  3     0x14200  acct          acct
 85611  472746  40540      0  3        0x82  piperd        syz-executor
 87137  355940  40540      0  3        0x82  nanoslp       syz-executor
 66178  361577  40540      0  3        0x82  nanoslp       syz-executor
 65334  474663  40540      0  2         0x2                syz-executor
 88880  277105  40540      0  3        0x82  nanoslp       syz-executor
 26610    6014  40540      0  3        0x82  nanoslp       syz-executor
 10814  288021  40540      0  3        0x82  nanoslp       syz-executor
 40540  462080      1      0  2         0x2                syz-executor
 28290  291887      1     74  3   0x1100092  bpf           pflogd
 58114  253528      1     73  3   0x1100090  kqread        syslogd
 38312   23669      0      0  3     0x14200  bored         smr
 35749  483851      0      0  2     0x14200      

Crashes (1601):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/24 00:40 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/24 00:39 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 21:52 openbsd 7a2e62a4900c 4c3406dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 19:37 openbsd 7a2e62a4900c 4c3406dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 18:16 openbsd 7a2e62a4900c 4c3406dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 16:38 openbsd 7a2e62a4900c 4c3406dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 15:22 openbsd 7a2e62a4900c 4c3406dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 13:52 openbsd 7a2e62a4900c 4c3406dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 10:04 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 07:49 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 07:07 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 06:06 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 04:56 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 03:28 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 02:08 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/23 00:53 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 23:44 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 17:54 openbsd 3802f0c790f9 4595e353 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 16:12 openbsd 3802f0c790f9 4595e353 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 14:06 openbsd 3802f0c790f9 4595e353 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 11:52 openbsd 3802f0c790f9 4595e353 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 09:29 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 08:21 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 05:47 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 04:23 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 01:50 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/22 00:39 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 21:30 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 19:27 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 17:39 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 15:40 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 14:31 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 12:24 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 11:37 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 09:03 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 06:59 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 05:06 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: savectx
2026/04/21 04:05 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/21 03:02 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/20 23:43 openbsd 84954924bf04 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/20 22:33 openbsd 84954924bf04 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/20 21:06 openbsd 84954924bf04 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2026/04/20 19:09 openbsd 84954924bf04 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
2025/12/17 19:14 openbsd 9c2b8e445a0b a066d2bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-setuid uvm_fault: savectx
2025/02/20 07:11 openbsd 483a78e15aaa 50668798 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: savectx
* Struck through repros no longer work on HEAD.