uvm_fault: scsi_xs_put

Status: upstream: reported on 2026/08/25 03:38
Reported-by: syzbot+b673ad0a7acf59f2fb13@syzkaller.appspotmail.com
First crash: 4d15h, last: 4d15h

Sample crash report:
uuvm_fault(0xfffff800790f0d08, 0x2, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      scsi_xs_put+0x4c:       movq    0(%r15),%rdi
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*361084  87629      0           0  0x4000000    0  syz-executor
scsi_xs_put(fffff8007a4f7960) at scsi_xs_put+0x4c scsi_iopool_put sys/scsi/scsi_base.c:270 [inline]
scsi_xs_put(fffff8007a4f7960) at scsi_xs_put+0x4c scsi_io_put sys/scsi/scsi_base.c:499 [inline]
scsi_xs_put(fffff8007a4f7960) at scsi_xs_put+0x4c sys/scsi/scsi_base.c:787
vioscsi_vq_done(ffff8000000a3618) at vioscsi_vq_done+0xe1 sys/dev/pv/vioscsi.c:-1
intr_handler(ffff80002a79af60,ffff8000002a2400) at intr_handler+0xcb sys/arch/amd64/amd64/intr.c:-1
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
Xspllower() at Xspllower+0x1d
cnputc(75) at cnputc+0x67 sys/dev/cons.c:218
db_putchar(75) at db_putchar+0x36d sys/ddb/db_output.c:155
kprintf() at kprintf+0x29c5 sys/kern/subr_prf.c:-1
db_printf(ffffffff8342efb5) at db_printf+0x9b sys/kern/subr_prf.c:-1
fault(ffffffff834e9699) at fault+0xa3 sys/arch/amd64/amd64/trap.c:163
kpageflttrap(ffff80002a79b3f0,32) at kpageflttrap+0x353 sys/arch/amd64/amd64/trap.c:298
kerntrap(ffff80002a79b3f0) at kerntrap+0x18a sys/arch/amd64/amd64/trap.c:532
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
mtx_enter(32) at mtx_enter+0x6e sys/kern/kern_lock.c:549
end trace frame: 0xffff80002a79b520, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> 

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/25 03:37 openbsd c0485cf4f019 614e416a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: scsi_xs_put
* Struck through repros no longer work on HEAD.