syzbot


assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (5)

Status: upstream: reported on 2025/05/20 01:41
Reported-by: syzbot+bcdac25d28da916ff365@syzkaller.appspotmail.com
First crash: 10d, last: 8d23h
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (4) C 9 1152d 1165d 3/3 fixed on 2022/04/05 02:42
openbsd assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c C 2 2345d 2345d 3/3 fixed on 2019/01/11 00:09
openbsd assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (2) syz 2 1263d 1263d 0/3 closed as invalid on 2022/02/22 18:45
openbsd assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c (3) syz 11 1175d 1191d 3/3 fixed on 2022/03/12 12:41

Sample crash report:
login: panic: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uvm_fault.c", line 1806
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*213191  20496      0           0  0x4000000    1K syz-executor
 131646  15209      0     0x14000 0x40000200    0  softclock
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83461c59) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8340b0e7,ffffffff833a3486,70e,ffffffff833a34bf) at __assert+0x29 sys/kern/subr_prf.c:-1
uvm_fault_unwire_locked(fffffd806beab200,200000000000,200000003000) at uvm_fault_unwire_locked+0x434 sys/uvm/uvm_fault.c:1803
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1766 [inline]
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1748
uvm_vslock_device(ffff800038ff7c58,200000000040,10000,3,ffff80003c494e60) at uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
physio(ffffffff81fe2130,d02,8000,ffffffff81fe2990,ffff80003c495118) at physio+0x277 sys/kern/kern_physio.c:139
spec_read(ffff80003c494f80) at spec_read+0x155 sys/kern/spec_vnops.c:215
VOP_READ(fffffd80703eaa40,ffff80003c495118,0,fffffd807f7d3618) at VOP_READ+0x102 sys/kern/vfs_vops.c:227
vn_read(fffffd806bec7e98,ffff80003c495118,1) at vn_read+0x17b sys/kern/vfs_vnops.c:369
dofilereadv(ffff800038ff7c58,3,ffff80003c495118,1,ffff80003c4951d0) at dofilereadv+0x230 sys/kern/sys_generic.c:252
sys_pread(ffff800038ff7c58,ffff80003c495280,ffff80003c4951d0) at sys_pread+0xae sys/kern/vfs_syscalls.c:3303
syscall(ffff80003c495280) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c495280) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x36ec979c710, count: 1
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/managers/multicore/kernel/sys/uvm/uvm_fault.c", line 1806
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83461c59) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8340b0e7,ffffffff833a3486,70e,ffffffff833a34bf) at __assert+0x29 sys/kern/subr_prf.c:-1
uvm_fault_unwire_locked(fffffd806beab200,200000000000,200000003000) at uvm_fault_unwire_locked+0x434 sys/uvm/uvm_fault.c:1803
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1766 [inline]
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1748
uvm_vslock_device(ffff800038ff7c58,200000000040,10000,3,ffff80003c494e60) at uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
physio(ffffffff81fe2130,d02,8000,ffffffff81fe2990,ffff80003c495118) at physio+0x277 sys/kern/kern_physio.c:139
spec_read(ffff80003c494f80) at spec_read+0x155 sys/kern/spec_vnops.c:215
VOP_READ(fffffd80703eaa40,ffff80003c495118,0,fffffd807f7d3618) at VOP_READ+0x102 sys/kern/vfs_vops.c:227
vn_read(fffffd806bec7e98,ffff80003c495118,1) at vn_read+0x17b sys/kern/vfs_vnops.c:369
dofilereadv(ffff800038ff7c58,3,ffff80003c495118,1,ffff80003c4951d0) at dofilereadv+0x230 sys/kern/sys_generic.c:252
sys_pread(ffff800038ff7c58,ffff80003c495280,ffff80003c4951d0) at sys_pread+0xae sys/kern/vfs_syscalls.c:3303
syscall(ffff80003c495280) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c495280) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x36ec979c710, count: -14
ddb{1}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff80003c494b70
rbx               0xffff8000299dedd7
rdx                                0
rcx               0xffff800038ff7c58
rax               0xffff8000299ddff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x66fafdf43cdfd609
r11               0xe48e803a72079d7d
r12               0xffff8000299debd8
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff811ff075    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff80003c494b60
ss                              0x10
db_enter+0x25:  addq    $0x8,%rsp
ddb{1}> show proc
PROC (syz-executor) tid=213191 pid=20496 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=36, usrpri=50, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800038ff6028,0xffffffff839ac7f0
    process=0xffff80003c4178c8 user=0xffff80003c490000, vmspace=0xfffffd806beab200
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 20496    2097  47941      0  2           0                syz-executor
 20496  457716  47941      0  2   0x4000000                syz-executor
 20496  161073  47941      0  2   0x4000000                syz-executor
*20496  213191  47941      0  7   0x4000000                syz-executor
 44066  445375  79883      0  2        0x10                syz-executor
 44066   21144  79883      0  2   0x4000010                syz-executor
 74444  382944  20939      0  2           0                syz-executor
 74444  139785  20939      0  3   0x4000080  fsleep        syz-executor
 74444  101001  20939      0  3   0x4000080  fsleep        syz-executor
 95832  278552   1629  60929  2        0x10                syz-executor
 95832  476923   1629  60929  3   0x4000090  kqread        syz-executor
 88999  458867  89326      0  2       0xc80                syz-executor
 88999  265319  89326      0  3   0x4000080  kqsel         syz-executor
 88999   56109  89326      0  3   0x4000080  fsleep        syz-executor
 99741  425296  89332      0  3        0x80  nanoslp       syz-executor
 99741  302141  89332      0  3   0x4000080  kqsel         syz-executor
  1629   75424  38521      0  3        0x82  nanoslp       syz-executor
 42115  170425      1      0  3    0x100083  ttyin         getty
 89332  464719  38521      0  3        0x82  nanoslp       syz-executor
 18902   10408  38521      0  3         0x2  biowait       syz-executor
  2221  265599  38521      0  3        0x82  nanoslp       syz-executor
 20939   22005  38521      0  3        0x82  nanoslp       syz-executor
 89326  183418  38521      0  2       0xc82                syz-executor
 23251  224563      0      0  3     0x14200  bored         sosplice
 79883  320151  38521      0  3        0x82  nanoslp       syz-executor
 47941  452701  38521      0  3        0x82  nanoslp       syz-executor
 38521  270991  91298      0  2         0x2                syz-executor
 91298  198513  30289      0  3    0x10008a  sigsusp       ksh
 30289  443116  56746      0  3        0x98  kqread        sshd-session
 56746  508799  47205      0  3        0x92  kqread        sshd-session
 47205   43499      1      0  3        0x88  kqread        sshd
 65231  175277  15512     74  3   0x1100092  bpf           pflogd
 15512  491418      1      0  3        0x80  sbwait        pflogd
  9613  458663   8756     73  3   0x1100090  kqread        syslogd
  8756  356119      1      0  3    0x100082  sbwait        syslogd
 23162  280556      1      0  3    0x100080  kqread        resolvd
 36097   45149  56907     77  3    0x100092  kqread        dhcpleased
 96737  270487  56907     77  3    0x100092  kqread        dhcpleased
 56907  254055      1      0  3        0x80  kqread        dhcpleased
 71641   41181      0      0  3     0x14200  bored         smr
 53494  229765      0      0  2     0x14200                zerothread
 22762   46356      0      0  3     0x14200  aiodoned      aiodoned
 75581  475906      0      0  3     0x14200  syncer        update
 16542  120770      0      0  3     0x14200  cleaner       cleaner
 71065  430467      0      0  3     0x14200  reaper        reaper
 28452  441761      0      0  3     0x14200  pgdaemon      pagedaemon
 27622  290694      0      0  3     0x14200  bored         viomb
 45269  347372      0      0  3  0x40014200  acpi0         acpi0
 85127  175786      0      0  3  0x40014200                idle1
 77590  144907      0      0  3     0x14200  bored         softnet3
 52846  400828      0      0  3     0x14200  bored         softnet2
 10102   61953      0      0  3     0x14200  bored         softnet1
  5984  205951      0      0  3     0x14200  bored         softnet0
 61227  294431      0      0  3     0x14200  bored         systqmp
 43297  481847      0      0  3     0x14200  bored         systq
 42270  401901      0      0  3     0x14200  tmoslp        softclockmp
 15209  131646      0      0  7  0x40014200                softclock
 37458  375415      0      0  3  0x40014200                idle0
     1  393458      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 20496 (syz-executor) thread 0xffff800038ff7c58 (213191)
exclusive rwlock amaplk r = 0 (0xfffffd805e22b3c0)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x367 sys/kern/kern_rwlock.c:311
#2  uvm_map_lock_entry+0x51 sys/uvm/uvm_map.c:464
#3  uvm_fault_unwire_locked+0x25d sys/uvm/uvm_fault.c:1818
#4  uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1766 [inline]
#4  uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1748
#5  uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
#6  physio+0x277 sys/kern/kern_physio.c:139
#7  spec_read+0x155 sys/kern/spec_vnops.c:215
#8  VOP_READ+0x102 sys/kern/vfs_vops.c:227
#9  vn_read+0x17b sys/kern/vfs_vnops.c:369
#10 dofilereadv+0x230 sys/kern/sys_generic.c:252
#11 sys_pread+0xae sys/kern/vfs_syscalls.c:3303
#12 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#12 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
#13 Xsyscall+0x128
shared rwlock vmmaplk r = 0 (0xfffffd806beab300)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x36e sys/kern/kern_rwlock.c:398
#2  uvm_fault_wire+0x116 uvm_fault_unwire sys/uvm/uvm_fault.c:1765 [inline]
#2  uvm_fault_wire+0x116 sys/uvm/uvm_fault.c:1748
#3  uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
#4  physio+0x277 sys/kern/kern_physio.c:139
#5  spec_read+0x155 sys/kern/spec_vnops.c:215
#6  VOP_READ+0x102 sys/kern/vfs_vops.c:227
#7  vn_read+0x17b sys/kern/vfs_vnops.c:369
#8  dofilereadv+0x230 sys/kern/sys_generic.c:252
#9  sys_pread+0xae sys/kern/vfs_syscalls.c:3303
#10 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
#11 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff839adb50)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
#2  mi_switch+0x4b7 sys/kern/sched_bsd.c:441
#3  sleep_finish+0x24f sys/kern/kern_synch.c:412
#4  rw_do_enter_read+0x2a7 sys/kern/kern_rwlock.c:380
#5  uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1924
#6  uvm_fault_check+0x4a sys/uvm/uvm_fault.c:741
#7  uvm_fault+0x106 sys/uvm/uvm_fault.c:677
#8  uvm_fault_wire+0x73 sys/uvm/uvm_fault.c:1745
#9  uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
#10 physio+0x277 sys/kern/kern_physio.c:139
#11 spec_read+0x155 sys/kern/spec_vnops.c:215
#12 VOP_READ+0x102 sys/kern/vfs_vops.c:227
#13 vn_read+0x17b sys/kern/vfs_vnops.c:369
#14 dofilereadv+0x230 sys/kern/sys_generic.c:252
#15 sys_pread+0xae sys/kern/vfs_syscalls.c:3303
#16 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#16 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
#17 Xsyscall+0x128
Process 18902 (syz-executor) thread 0xffff8000ffff0cf0 (10408)
exclusive rrwlock inode r = 0 (0xfffffd807cd621e8)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x367 sys/kern/kern_rwlock.c:311
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:606
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  ufs_ihashins+0x4f ufs_ihash sys/ufs/ufs/ufs_ihash.c:-1 [inline]
#4  ufs_ihashins+0x4f sys/ufs/ufs/ufs_ihash.c:159
#5  ffs_vget+0x187 sys/ufs/ffs/ffs_vfsops.c:1230
#6  ffs_inode_alloc+0x283 sys/ufs/ffs/ffs_alloc.c:393
#7  ufs_mkdir+0x113 sys/ufs/ufs/ufs_vnops.c:1112
#8  VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
#9  domkdirat+0x179 sys/kern/vfs_syscalls.c:3109
#10 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#10 syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#11 Xsyscall+0x128
exclusive rrwlock inode r = 0 (0xfffffd806c723f80)
#0  witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5bb sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x367 sys/kern/kern_rwlock.c:311
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:606
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x109 sys/kern/vfs_lookup.c:418
#6  namei+0x7aa sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3094
#8  syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb08 sys/arch/amd64/amd64/trap.c:579
#9  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10236  11039K   11567K 166960K     13821        0
            pcb    18     12K      12K 166960K       152        0
         rtable   221     10K      10K 166960K      1244        0
             pf    34     17K      21K 166960K       140        0
         ifaddr    41      7K       8K 166960K       112        0
        ifgroup    55      2K       2K 166960K       166        0
         sysctl     4      1K       9K 166960K        13        0
       counters    68     36K      38K 166960K       172        0
       ioctlops     0      0K       4K 166960K      1609        0
            iov     0      0K      28K 166960K       143        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1395     88K      89K 166960K      2745        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        23        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        96        0
        dirhash    12      2K       3K 166960K        42        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K      97K 166960K      1217        0
          sigio     1      0K       0K 166960K        28        0
           proc    72     91K     128K 166960K       870        0
        subproc    72      4K       4K 166960K       144        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       172        0
       in_multi    88      6K       7K 166960K       214        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     1      0K       0K 166960K         6        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   247   1102K    1102K 166960K       247        0
           exec     0      0K       1K 166960K       697        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         4        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   249    177K     191K 166960K     12488        0
       UVM aobj    16      2K       4K 166960K        18        0
     pinsyscall    42     84K     108K 166960K      2546        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K        67        0
            NDP    14      0K       2K 166960K        76        0
           temp    74   8682K    8747K 166960K     43013        0
         kqueue    14     22K      30K 166960K       209        0
      SYN cache     2     10K      18K 166960K         3        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      119    0      116     1     0     1     1     0     8    0
rtentry    176      481    0      388     6     0     6     6     0     8    1
unpcb      144      946    0      928     9     3     6     6     0     8    5
syncache   336        9    0        9     2     2     0     1     0     8    0
tcpqe       32        2    0        2     1     1     0     1     0     8    0
tcpcb      808      439    0      432    13     5     8     8     0     8    7
arp        128      102    0       84     1     0     1     1     0     8    0
inpcb      384     1081    0     1065    16     7     9     9     0     8    7
nd6        144       51    0       28     1     0     1     1     0     8    0
pkpcb       40       12    0       12     2     1     1     1     0     8    1
kcovpl      48       16    0        8     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     0     1     1     0     8    1
ppxss      1192      33    0       33     2     1     1     1     0     8    1
pppxif     1504       6    0        6     2     1     1     1     0     8    1
pffrag     232        6    0        0     1     0     1     1     0   482    0
pffrnode    88        6    0        0     1     0     1     1     0     8    0
pffrent     40        8    0        2     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pfanchor   1288       3    0        0     1     0     1     1     0     8    0
pfstitem    24       69    0       12     1     0     1     1     0     8    0
pfstkey    128       69    0       12     2     0     2     2     0     8    0
pfstate    384       69    0       12     6     0     6     6     0     8    0
pfrule     1344      27    0       20     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      965    0      555    32     5    27    29     0     8    1
art_table   32      967    0      555     4     0     4     4     0     8    0
art_node    16      349    0      267     1     0     1     1     0     8    0
sysvmsgpl   40       19    0       13     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       93    0       83     1     0     1     1     0     8    0
shmpl      112       15    0        2     1     0     1     1     0     8    0
dirhash    1024      37    0       20     3     0     3     3     0     8    0
dino2pl    256     3530    0     2012    96     0    96    96     0     8    0
ffsino     288     3530    0     2012   109     0   109   109     0     8    0
nchpl      144     5107    0     3395    64     0    64    64     0     8    0
rtmask      32       11    0       11     2     1     1     1     0     8    1
uvmvnodes   80     4522    0        0    93     0    93    93     0     8    0
vnodes     216     4522    0        0   252     0   252   252     0     8    0
namei      1024   18500    0    18499     3     2     1     2     0     8    0
percpumem   16      101    0       52     1     0     1     1     0     8    0
kstatmem   264       92    0       64     5     2     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        3    0        3     2     1     1     1     0     8    1
scxspl     216    15121    0    15120    11     9     2     8     1     8    1
plimitpl   152      309    0      292     1     0     1     1     0     8    0
sigapl     424     1512    0     1462     8     1     7     7     0     8    0
knotepl    120      322    0        0    10     0    10    10     0     8    0
kqueuepl   224      507    0      495    10     5     5     5     0     8    4
pipepl     336      387    0      358     9     1     8     8     0     8    5
fdescpl    520     1491    0     1460     3     0     3     3     0     8    0
filepl     160     9991    0     9768    21     1    20    20     0     8    6
lockfpl    104      312    0      310     1     0     1     1     0     8    0
lockfspl    48      108    0      106     1     0     1     1     0     8    0
sessionpl  144       37    0       28     1     0     1     1     0     8    0
pgrppl      48      165    0      148     1     0     1     1     0     8    0
ucredpl    104     1649    0     1634     1     0     1     1     0     8    0
zombiepl   144     1463    0     1462     1     0     1     1     0     8    0
processpl  1208    1512    0     1462     6     1     5     5     0     8    0
procpl     656     3212    0     3152     6     0     6     6     0     8    0
srpgc       96       18    0       18     2     1     1     1     0     8    1
sosppl     168        7    0        7     2     1     1     1     0     8    1
sockpl     728     2175    0     2138    22    11    11    16     0     8    7
mcl64k     65536      5    0        0     1     0     1     1     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     111    0        0    14     0    14    14     0     8    0
mcl2k      2048      54    0        0     6     0     6     6     0     8    0
mtagpl      96      140    0        0     4     0     4     4     0     8    0
mbufpl     256     1249    0        0    78     0    78    78     0     8    0
bufpl      280     6240    0      128   437     0   437   437     0     8    0
anonpl      32     7697    0        0    62     0    62    62     0   246    0
amapchunkpl 152   40310    0    39791    35     8    27    31     0   158    4
amappl16   200     4086    0     4052    37    23    14    15     0     8   11
amappl15   192       35    0       34     1     0     1     1     0     8    0
amappl14   184      139    0      127     1     0     1     1     0     8    0
amappl13   176        1    0        1     1     1     0     1     0     8    0
amappl12   168     2273    0     2242     4     2     2     3     0     8    0
amappl11   160       52    0       38     1     0     1     1     0     8    0
amappl10   152       21    0       21     2     2     0     1     0     8    0
amappl9    144      329    0      329     1     1     0     1     0     8    0
amappl8    136       33    0       29     1     0     1     1     0     8    0
amappl7    128      145    0      133     1     0     1     1     0     8    0
amappl6    120      276    0      272     1     0     1     1     0     8    0
amappl5    112      170    0      160     1     0     1     1     0     8    0
amappl4    104      376    0      354     1     0     1     1     0     8    0
amappl3     96     8147    0     8028     4     0     4     4     0     8    0
amappl2     88      836    0      771     2     0     2     2     0     8    0
amappl1     80    14331    0    13732    18     3    15    15     0     8    0
amappl      88    11437    0    11266     5     0     5     5     0    92    0
dma8192    8192       2    0        2     1     0     1     1     0     8    1
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       17    0        2     1     0     1     1     0     8    0
uaddrrnd    24     1491    0     1460     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1491    0     1460     1     0     1     1     0     8    0
vmmpekpl   168    13272    0    13200     4     0     4     4     0     8    0
vmmpepl    168    99390    0    97376   107     6   101   101     0   357    7
vmsppl     480     1490    0     1460     5     0     5     5     0     8    0
rwobjpl     72    32081    0    26591   102     0   102   102     0     8    2
pdppl      4096    2989    0     2920   113    40    73    87     0     8    4
pvpl        32    15065    0        0   123     1   122   122     0   265    0
pmappl     256     1490    0     1460     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      491    0       57    13     0    13    13     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff8381aff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 sys/kern/kern_lock.c:144
intr_handler(ffff80002a1f83a0,ffff800000079f00) at intr_handler+0xe1 sys/arch/amd64/amd64/intr.c:559
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 sys/kern/kern_lock.c:144
__mp_acquire_count(ffffffff839ad948,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
mi_switch() at mi_switch+0x4b7 sys/kern/sched_bsd.c:441
sleep_finish(0,1) at sleep_finish+0x24f sys/kern/kern_synch.c:412
softclock_thread_run(ffffffff83872758) at softclock_thread_run+0x74 sys/kern/kern_timeout.c:828
softclock_thread(ffff8000fffff1f0) at softclock_thread+0x10a sys/kern/kern_timeout.c:850
end trace frame: 0x0, count: 3
ddb{0}> trace
x86_ipi_db(ffffffff8381aff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 sys/kern/kern_lock.c:144
intr_handler(ffff80002a1f83a0,ffff800000079f00) at intr_handler+0xe1 sys/arch/amd64/amd64/intr.c:559
Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff839ad948) at __mp_lock+0x192 sys/kern/kern_lock.c:144
__mp_acquire_count(ffffffff839ad948,1) at __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
mi_switch() at mi_switch+0x4b7 sys/kern/sched_bsd.c:441
sleep_finish(0,1) at sleep_finish+0x24f sys/kern/kern_synch.c:412
softclock_thread_run(ffffffff83872758) at softclock_thread_run+0x74 sys/kern/kern_timeout.c:828
softclock_thread(ffff8000fffff1f0) at softclock_thread+0x10a sys/kern/kern_timeout.c:850
end trace frame: 0x0, count: -12
ddb{0}> machine ddbcpu 1
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83461c59) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8340b0e7,ffffffff833a3486,70e,ffffffff833a34bf) at __assert+0x29 sys/kern/subr_prf.c:-1
uvm_fault_unwire_locked(fffffd806beab200,200000000000,200000003000) at uvm_fault_unwire_locked+0x434 sys/uvm/uvm_fault.c:1803
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1766 [inline]
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1748
uvm_vslock_device(ffff800038ff7c58,200000000040,10000,3,ffff80003c494e60) at uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
physio(ffffffff81fe2130,d02,8000,ffffffff81fe2990,ffff80003c495118) at physio+0x277 sys/kern/kern_physio.c:139
spec_read(ffff80003c494f80) at spec_read+0x155 sys/kern/spec_vnops.c:215
VOP_READ(fffffd80703eaa40,ffff80003c495118,0,fffffd807f7d3618) at VOP_READ+0x102 sys/kern/vfs_vops.c:227
vn_read(fffffd806bec7e98,ffff80003c495118,1) at vn_read+0x17b sys/kern/vfs_vnops.c:369
dofilereadv(ffff800038ff7c58,3,ffff80003c495118,1,ffff80003c4951d0) at dofilereadv+0x230 sys/kern/sys_generic.c:252
sys_pread(ffff800038ff7c58,ffff80003c495280,ffff80003c4951d0) at sys_pread+0xae sys/kern/vfs_syscalls.c:3303
syscall(ffff80003c495280) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c495280) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x36ec979c710, count: 1
ddb{1}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83461c59) at panic+0x1e5 sys/kern/subr_prf.c:198
__assert(ffffffff8340b0e7,ffffffff833a3486,70e,ffffffff833a34bf) at __assert+0x29 sys/kern/subr_prf.c:-1
uvm_fault_unwire_locked(fffffd806beab200,200000000000,200000003000) at uvm_fault_unwire_locked+0x434 sys/uvm/uvm_fault.c:1803
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1766 [inline]
uvm_fault_wire(fffffd806beab200,200000000000,200000011000,3) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1748
uvm_vslock_device(ffff800038ff7c58,200000000040,10000,3,ffff80003c494e60) at uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
physio(ffffffff81fe2130,d02,8000,ffffffff81fe2990,ffff80003c495118) at physio+0x277 sys/kern/kern_physio.c:139
spec_read(ffff80003c494f80) at spec_read+0x155 sys/kern/spec_vnops.c:215
VOP_READ(fffffd80703eaa40,ffff80003c495118,0,fffffd807f7d3618) at VOP_READ+0x102 sys/kern/vfs_vops.c:227
vn_read(fffffd806bec7e98,ffff80003c495118,1) at vn_read+0x17b sys/kern/vfs_vnops.c:369
dofilereadv(ffff800038ff7c58,3,ffff80003c495118,1,ffff80003c4951d0) at dofilereadv+0x230 sys/kern/sys_generic.c:252
sys_pread(ffff800038ff7c58,ffff80003c495280,ffff80003c4951d0) at sys_pread+0xae sys/kern/vfs_syscalls.c:3303
syscall(ffff80003c495280) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c495280) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:579
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x36ec979c710, count: -14

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/21 08:18 openbsd 1363fb036962 b47f9e02 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c
2025/05/20 01:40 openbsd 03d4002980cf b84f0537 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore assert "next != NULL && next->start <= entry->end" failed in uvm_fault.c
* Struck through repros no longer work on HEAD.