uvm_fault: schedclock

Status: auto-obsoleted due to no activity on 2026/09/08 09:48
Reported-by: syzbot+c0a2f5b539e2150f7cfa@syzkaller.appspotmail.com
First crash: 1109d, last: 740d
Last patch testing requests (10)
Created Duration User Patch Repo Result
2026/09/08 09:19 27m retest repro openbsd no crash job log log
2026/06/30 08:51 26m retest repro openbsd report log
2026/04/21 08:29 17m retest repro openbsd report log
2026/02/10 08:09 16m retest repro openbsd report log
2025/12/02 07:49 14m retest repro openbsd report log
2025/09/23 07:28 15m retest repro openbsd report log
2025/07/15 07:11 16m retest repro openbsd report log
2025/05/06 06:55 15m retest repro openbsd report log
2025/02/25 06:30 15m retest repro openbsd report log
2024/12/17 06:14 15m retest repro openbsd report log

Sample crash report:
kernel: page fault trap, code=0
Stopped at      schedclock+0xc0:        movzbl  0x35c(%rax),%eax
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
schedclock(ffff80002a4c2018) at schedclock+0xc0 sys/kern/sched_bsd.c:556
statclock(ffffffff833eac08,ffff800035a1e530,0) at statclock+0x296 sys/kern/kern_clock.c:330
clockintr_dispatch(ffff800035a1e530) at clockintr_dispatch+0x32a
lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
__sanitizer_cov_trace_cmp8(ffff800035a1e698,fffffd8006ed8b00) at __sanitizer_cov_trace_cmp8+0xf sys/dev/kcov.c:216
_rb_find(ffffffff833869e0,fffffd80735b3220,ffff800035a1e698) at _rb_find+0x68 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd80735b3210,2e8e000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd80735b3210,2e8e000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1213
buf_map(fffffd80735b3150) at buf_map+0x2a6
buf_get(0,0,3d65f18) at buf_get+0x5b5 sys/kern/vfs_bio.c:1175
geteblk(3d65f18) at geteblk+0x3c
readdisklabel(2902,ffffffff82c7f8d0,ffff8000011d3600,0) at readdisklabel+0x1c4 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,1,2000,ffff80002a4c2018) at vndopen+0x207 sys/dev/vnd.c:204
spec_open(ffff800035a1ead8) at spec_open+0x2e9 sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd806e9fcb58,1,fffffd807f7d78f0,ffff80002a4c2018) at VOP_OPEN+0x82 sys/kern/vfs_vops.c:138
vn_open(ffff800035a1ed28,201,0) at vn_open+0x708 sys/kern/vfs_vnops.c:177
doopenat(ffff80002a4c2018,ffffff9c,20000200,200,0,ffff800035a1eed0) at doopenat+0x31d sys/kern/vfs_syscalls.c:1123
syscall(ffff800035a1ef80) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xb7c4cfe2000, count: -19
ddb> show registers
rdi                       0xffffffff
rsi                              0xc
rbp               0xffff800035a1e420
rbx               0xffffffff828686f0    statclock
rdx                                0
rcx               0xffffffff833e9ff0    cpu_info_full_primary+0x1ff0
rax                                0
r8                                 0
r9                                 0
r10                                0
r11               0x6bb85a2310474fa0
r12                           0x3ac4    __ALIGN_SIZE+0x2ac4
r13                                0
r14               0xffff80002a4c2018
r15                                0
rip               0xffffffff81bad7c0    schedclock+0xc0
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff800035a1e3d0
ss                              0x10
schedclock+0xc0:        movzbl  0x35c(%rax),%eax
ddb> show proc
kernel: page fault trap, code=0
Faulted in DDB; continuing...
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10181  10020K   10222K 166960K     11465        0
            pcb    17     14K      15K 166960K        59        0
         rtable   204      8K       9K 166960K      1079        0
             pf    30     12K      13K 166960K        81        0
         ifaddr    39      7K       7K 166960K       143        0
        ifgroup    50      2K       2K 166960K       147        0
         sysctl     1      0K       0K 166960K         1        0
       counters    30     17K      17K 166960K        54        0
       ioctlops     0      0K       4K 166960K        65        0
            iov     0      0K      12K 166960K        15        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1371     86K      87K 166960K      1813        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        10        0
         VM map     2      1K       1K 166960K         2        0
            sem     5      0K       0K 166960K         5        0
        dirhash    12      2K       2K 166960K        18        0
           ACPI  1690    195K     286K 166960K     12418        0
      file desc    16     57K      93K 166960K       634        0
          sigio     0      0K       0K 166960K         1        0
           proc    58     59K      91K 166960K      1129        0
        subproc   104      6K       6K 166960K       403        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        27        0
       in_multi    86      6K       7K 166960K       351        0
    ether_multi     1      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    85    387K     387K 166960K        85        0
           exec     0      0K       1K 166960K       792        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   187     71K      90K 166960K      6323        0
       UVM aobj     9      2K       2K 166960K        13        0
     pinsyscall    37     74K     100K 166960K      2459        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K         9        0
            NDP    15      0K       1K 166960K        95        0
           temp    75   6816K    6880K 166960K     22743        0
         kqueue    13     20K      26K 166960K        39        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       86    0       83     1     0     1     1     0     8    0
rtentry    112      375    0      283     4     0     4     4     0     8    0
unpcb      144      183    0      166     3     0     3     3     0     8    2
syncache   336        3    0        3     1     0     1     1     0     8    1
tcpcb      808       46    0       42     1     0     1     1     0     8    0
arp         88       68    0       50     1     0     1     1     0     8    0
ipq         40        1    0        0     1     0     1     1     0     8    0
ipqe        40        1    0        0     1     0     1     1     0     8    0
inpcb      336      413    0      406    12     3     9    12     0     8    8
nd6        104       91    0       71     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     0     1     1     0     8    1
kcovpl      48       31    0       23     1     0     1     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     1458    0     1082    29     0    29    29     0     8    5
art_table   32     1460    0     1082     4     0     4     4     0     8    0
art_node    16      374    0      291     1     0     1     1     0     8    0
sysvmsgpl   40        3    0        0     1     0     1     1     0     8    0
semapl     112        3    0        0     1     0     1     1     0     8    0
shmpl      112       10    0        4     1     0     1     1     0     8    0
dirhash    1024      21    0        4     3     0     3     3     0     8    0
dirhash: pool(0xffffffff835d03c0:dirhash): free list modified: page 0xffff80002a49e000; item ordinal 0; addr 0xffff80002a49e800 (p 0xfffffd8073acc000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff80002a49e000; item ordinal 0; addr 0xffff80002a49e800 (p 0xfffffd8073acc000); offset 0x0=0x0
dirhash: pool(0xffffffff835d03c0:dirhash): page inconsistency: page 0xffff80002a49e000; item ordinal 1; addr 0x3301765a3a9c9bac
dino2pl    256     1931    0      392    97     0    97    97     0     8    0
ffsino     240     1931    0      392    91     0    91    91     0     8    0
nchpl      144     2358    0      657    64     0    64    64     0     8    0
uvmvnodes   80     2387    0        0    49     0    49    49     0     8    0
vnodes     216     2387    0        0   133     0   133   133     0     8    0
namei      1024   10030    0    10029     2     0     2     2     0     8    1
namei: pool(0xffffffff834c8b08:namei): free list modified: page 0xffff80002a47a000; item ordinal 0; addr 0xffff80002a47b000 (p 0xfffffd807f7e4000); offset 0x0=0x0
pool(namei): free list modified: page 0xffff80002a47a000; item ordinal 0; addr 0xffff80002a47b000 (p 0xfffffd807f7e4000); offset 0x0=0x0
namei: pool(0xffffffff834c8b08:namei): page inconsistency: page 0xffff80002a47a000; item ordinal 1; addr 0x9b494fb51bc0bf26
kstatmem   264       70    0       48     2     0     2     2     0     8    0
scxspl     216    11429    0    11427     8     0     8     8     1     8    7
plimitpl   152       82    0       66     1     0     1     1     0     8    0
sigapl     424      931    0      886     7     0     7     7     0     8    1
futexpl     64     2653    0     2651     1     0     1     1     0     8    0
knotepl    120     7333    0     7286     2     0     2     2     0     8    0
kqueuepl   184       58    0       49     1     0     1     1     0     8    0
pipepl     288      182    0      155     3     0     3     3     0     8    0
fdescpl    432      914    0      886     5     0     5     5     0     8    1
filepl     120     3607    0     3369    14     0    14    14     0     8    6
lockfpl    104      128    0      126     2     0     2     2     0     8    1
lockfspl    48       30    0       28     1     0     1     1     0     8    0
sessionpl  144       44    0       36     1     0     1     1     0     8    0
pgrppl      48       78    0       62     1     0     1     1     0     8    0
ucredpl    104      376    0      362     1     0     1     1     0     8    0
zombiepl   144      886    0      886     1     0     1     1     0     8    1
processpl  1096     931    0      886     4     0     4     4     0     8    0
processpl: pool(0xffffffff83565a50:processpl): page inconsistency: page 0x0; at page head addr 0xffff80002a467f90 (p 0xffff80002a464000)
procpl     648     1158    0     1110     6     0     6     6     0     8    1
procpl: pool(0xffffffff835658a8:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a40df90 (p 0xffff80002a40c000)
procpl: pool(0xffffffff835658a8:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a457f90 (p 0xffff80002a456000)
sockpl     504      688    0      661    21     9    12    21     0     8    7
mcl64k     65536      1    0        1     1     0     1     1     0     8    1
mcl16k     16384      1    0        1     1     0     1     1     0     8    1
mcl8k      8192       8    0        8     1     0     1     1     0     8    1
mcl4k      4096       3    0        3     1     0     1     1     0     8    1
mcl2k      2048    5670    0     5569    29     8    21    29     0     8    6
mtagpl      96        7    0        7     1     0     1     1     0     8    1
mbufpl     256     9743    0     9558    16     0    16    16     0     8    2
bufpl      280     5991    0       92   422     0   422   422     0     8    0
anonpl      24   189342    0   186461    80     0    80    80     0   187   51
amapchunkpl 152   19525    0    19157    43     0    43    43     0   158   26
amappl16   200     3999    0     3992    20    12     8    14     0     8    7
amappl15   192        6    0        6     1     0     1     1     0     8    1
amappl14   184      186    0      176     1     0     1     1     0     8    0
amappl13   176       14    0       14     1     0     1     1     0     8    1
amappl12   168     1993    0     1968     2     0     2     2     0     8    0
amappl11   160       50    0       40     1     0     1     1     0     8    0
amappl10   152        9    0        9     1     0     1     1     0     8    1
amappl9    144      143    0      143     1     0     1     1     0     8    1
amappl8    136       52    0       51     1     0     1     1     0     8    0
amappl7    128      175    0      165     1     0     1     1     0     8    0
amappl6    120      383    0      382     1     0     1     1     0     8    0
amappl5    112      229    0      221     1     0     1     1     0     8    0
amappl4    104      392    0      375     1     0     1     1     0     8    0
amappl3     96     3341    0     3269     3     0     3     3     0     8    0
amappl2     88     1222    0     1154     2     0     2     2     0     8    0
amappl1     80    11239    0    10710    14     0    14    14     0     8    2
amappl      88     5676    0     5543     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      253    0      253     1     0     1     1     0     8    1
dma64       64        6    0        6     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       12    0        4     1     0     1     1     0     8    0
uaddrrnd    24      914    0      886     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      914    0      886     1     0     1     1     0     8    0
vmmpekpl   168    11302    0    11250     3     0     3     3     0     8    0
vmmpepl    168    64265    0    62636    90     0    90    90     0   357   15
vmsppl     344      913    0      886     4     0     4     4     0     8    1
rwobjpl     24    24380    0    21183    20     0    20    20     0     8    0
pdppl      4096    1835    0     1772   137    66    71    85     0     8    8
pvpl        32   525994    0   517834   353    10   343   353     0   265  264
pmappl     216      913    0      886     3     0     3     3     0     8    1
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      451    0       86    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
schedclock(ffff80002a4c2018) at schedclock+0xc0 sys/kern/sched_bsd.c:556
statclock(ffffffff833eac08,ffff800035a1e530,0) at statclock+0x296 sys/kern/kern_clock.c:330
clockintr_dispatch(ffff800035a1e530) at clockintr_dispatch+0x32a
lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
__sanitizer_cov_trace_cmp8(ffff800035a1e698,fffffd8006ed8b00) at __sanitizer_cov_trace_cmp8+0xf sys/dev/kcov.c:216
_rb_find(ffffffff833869e0,fffffd80735b3220,ffff800035a1e698) at _rb_find+0x68 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd80735b3210,2e8e000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd80735b3210,2e8e000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1213
buf_map(fffffd80735b3150) at buf_map+0x2a6
buf_get(0,0,3d65f18) at buf_get+0x5b5 sys/kern/vfs_bio.c:1175
geteblk(3d65f18) at geteblk+0x3c
readdisklabel(2902,ffffffff82c7f8d0,ffff8000011d3600,0) at readdisklabel+0x1c4 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,1,2000,ffff80002a4c2018) at vndopen+0x207 sys/dev/vnd.c:204
spec_open(ffff800035a1ead8) at spec_open+0x2e9 sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd806e9fcb58,1,fffffd807f7d78f0,ffff80002a4c2018) at VOP_OPEN+0x82 sys/kern/vfs_vops.c:138
vn_open(ffff800035a1ed28,201,0) at vn_open+0x708 sys/kern/vfs_vnops.c:177
doopenat(ffff80002a4c2018,ffffff9c,20000200,200,0,ffff800035a1eed0) at doopenat+0x31d sys/kern/vfs_syscalls.c:1123
syscall(ffff800035a1ef80) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xb7c4cfe2000, count: -19
ddb> machine ddbcpu 1
No such command
ddb> trace
schedclock(ffff80002a4c2018) at schedclock+0xc0 sys/kern/sched_bsd.c:556
statclock(ffffffff833eac08,ffff800035a1e530,0) at statclock+0x296 sys/kern/kern_clock.c:330
clockintr_dispatch(ffff800035a1e530) at clockintr_dispatch+0x32a
lapic_clockintr(0,0) at lapic_clockintr+0x43 sys/arch/amd64/amd64/lapic.c:482
Xresume_lapic_ltimer() at Xresume_lapic_ltimer+0x2a
__sanitizer_cov_trace_cmp8(ffff800035a1e698,fffffd8006ed8b00) at __sanitizer_cov_trace_cmp8+0xf sys/dev/kcov.c:216
_rb_find(ffffffff833869e0,fffffd80735b3220,ffff800035a1e698) at _rb_find+0x68 sys/kern/subr_tree.c:450
uvm_pagelookup(fffffd80735b3210,2e8e000) at uvm_pagelookup+0x51 uvm_objtree_RBT_FIND sys/uvm/uvm_object.h:93 [inline]
uvm_pagelookup(fffffd80735b3210,2e8e000) at uvm_pagelookup+0x51 sys/uvm/uvm_page.c:1213
buf_map(fffffd80735b3150) at buf_map+0x2a6
buf_get(0,0,3d65f18) at buf_get+0x5b5 sys/kern/vfs_bio.c:1175
geteblk(3d65f18) at geteblk+0x3c
readdisklabel(2902,ffffffff82c7f8d0,ffff8000011d3600,0) at readdisklabel+0x1c4 sys/arch/amd64/amd64/disksubr.c:96
vndopen(2902,1,2000,ffff80002a4c2018) at vndopen+0x207 sys/dev/vnd.c:204
spec_open(ffff800035a1ead8) at spec_open+0x2e9 sys/kern/spec_vnops.c:150
VOP_OPEN(fffffd806e9fcb58,1,fffffd807f7d78f0,ffff80002a4c2018) at VOP_OPEN+0x82 sys/kern/vfs_vops.c:138
vn_open(ffff800035a1ed28,201,0) at vn_open+0x708 sys/kern/vfs_vnops.c:177
doopenat(ffff80002a4c2018,ffffff9c,20000200,200,0,ffff800035a1eed0) at doopenat+0x31d sys/kern/vfs_syscalls.c:1123
syscall(ffff800035a1ef80) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xb7c4cfe2000, count: -19

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/05 12:13 openbsd ebe65f64a6a1 464ac2ed .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2024/03/31 13:13 openbsd 2ee472d028ec 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2024/03/29 17:03 openbsd 2ee472d028ec 6ee49f2e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2024/02/27 04:47 openbsd 53ff252d078f 05e69c83 .config console log report syz [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2024/02/27 04:00 openbsd 53ff252d078f 05e69c83 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2024/02/09 16:58 openbsd 06bc238730aa 77b23aa1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2024/01/28 07:31 openbsd a847d16f3e06 cc4a4020 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2024/01/21 13:59 openbsd 1b9db5f20e8d 9bd8dcda .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2023/10/29 19:33 openbsd c8ef2279606a 3c418d72 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2023/10/10 05:29 openbsd ab096723d8be c9be5398 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
2023/09/03 03:58 openbsd a514d4594e28 696ea0d2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: schedclock
* Struck through repros no longer work on HEAD.