syzbot


uvm_fault: spec_getattr (2)

Status: upstream: reported on 2025/10/11 03:39
Reported-by: syzbot+c553d0bd0068271f9e30@syzkaller.appspotmail.com
First crash: 54d, last: 38d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: spec_getattr -1 1 401d 401d 0/3 auto-obsoleted due to no activity on 2025/01/26 16:32

Sample crash report:
uvm_fault(0xfffffd806be89208, 0x30, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      spec_getattr+0x9f:      movq    0x30(%rax),%rdi
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*127973   7042      0           0  0x4000000    0K syz-executor
 156633  28549     77    0x100012        0x1    1  dhcpleased
spec_getattr(ffff80002a340428) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd805c8b6018,ffff80002a3404a0,fffffd80097fb2d8,ffff80003c444800) at VOP_GETATTR+0x88 sys/kern/vfs_vops.c:191
fill_file(ffff8000014b6c00,fffffd806cf9b1f8,ffff8000fffeaa60,3,0,ffff800037fe9840,2a4635c6f2dd633,3,7ffffaf) at fill_file+0x5dc sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a3408f8,4,200000000100,ffff80002a340928,ffff80003c444800) at sysctl_file+0x7d7 sys/kern/kern_sysctl.c:1866
kern_sysctl(ffff80002a3408f4,5,200000000100,ffff80002a340928,0,37,fe312a57b195de94) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80003c444800,ffff80002a340a60,ffff80002a3409b0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a340a60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a340a60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8e0bdaba0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffffd806be89208, 0x30, 0, 1) -> e
ddb{0}> trace
spec_getattr(ffff80002a340428) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd805c8b6018,ffff80002a3404a0,fffffd80097fb2d8,ffff80003c444800) at VOP_GETATTR+0x88 sys/kern/vfs_vops.c:191
fill_file(ffff8000014b6c00,fffffd806cf9b1f8,ffff8000fffeaa60,3,0,ffff800037fe9840,2a4635c6f2dd633,3,7ffffaf) at fill_file+0x5dc sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a3408f8,4,200000000100,ffff80002a340928,ffff80003c444800) at sysctl_file+0x7d7 sys/kern/kern_sysctl.c:1866
kern_sysctl(ffff80002a3408f4,5,200000000100,ffff80002a340928,0,37,fe312a57b195de94) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80003c444800,ffff80002a340a60,ffff80002a3409b0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a340a60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a340a60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8e0bdaba0, count: -8
ddb{0}> show registers
rdi               0xffff8000357ed000
rsi                          0x2863c    acpi_pdirpa+0x144ad
rbp               0xffff80002a340410
rbx               0xfffffd805c8b6018
rdx               0xffff8000357ed000
rcx                          0x2863b    acpi_pdirpa+0x144ac
rax                                0
r8                0xffff80003c4324c0
r9                                 0
r10               0x2cc678b256d06426
r11               0x8e900270a7f99699
r12                           0x8000    __ALIGN_SIZE+0x7000
r13               0xffff80002a3404a0
r14               0xffff80002a340428
r15               0xfffffd805c8b6018
rip               0xffffffff8182e88f    spec_getattr+0x9f
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a3403e0
ss                              0x10
spec_getattr+0x9f:      movq    0x30(%rax),%rdi
ddb{0}> show proc
PROC (syz-executor) tid=127973 pid=7042 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c445cc0,0xffffffff83946580
    process=0xffff800037fe9d10 user=0xffff80002a33b000, vmspace=0xfffffd806be89208
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  7042  435945  48589      0  2           0                syz-executor
* 7042  127973  48589      0  7   0x4000000                syz-executor
 28808  418008  90320      0  2           0                syz-executor
 28808  192167  90320      0  3   0x4000080  fsleep        syz-executor
 43868   90664  98885      0  2           0                syz-executor
 43868  470930  98885      0  3   0x4000080  fsleep        syz-executor
 43868   88207  98885      0  2   0x4000000                syz-executor
 50282  128542  91243      0  2      0x1044                syz-executor
 99831  180467   2149      0  3        0x80  nanoslp       syz-executor
 99831   76495   2149      0  3   0x4000080  fifow         syz-executor
 99831  164248   2149      0  3   0x4000080  fsleep        syz-executor
 66718  502059  97007      0  3        0x80  nanoslp       syz-executor
 66718  518706  97007      0  2   0x4000000                syz-executor
 66718  174508  97007      0  3   0x4000080  fsleep        syz-executor
 90962   14420  91277      0  2           0                syz-executor
 90962  509246  91277      0  3   0x4000080  ttyout        syz-executor
 90962   87678  91277      0  3   0x4000080  fsleep        syz-executor
 91243  513806  64175      0  3        0x82  ppwait        syz-executor
  4749  311467  64175      0  3        0x82  nanoslp       syz-executor
  2149  356448  64175      0  3        0x82  nanoslp       syz-executor
 89712  140333      0      0  3     0x14280  nfsidl        nfsio
 25859  353409      0      0  3     0x14280  nfsidl        nfsio
 30266  286086      0      0  3     0x14280  nfsidl        nfsio
 56841  310378      0      0  3     0x14280  nfsidl        nfsio
 39681  404184      0      0  3     0x14280  nfsidl        nfsio
 16524  309277      0      0  3     0x14280  nfsidl        nfsio
   597   34896      0      0  3     0x14280  nfsidl        nfsio
 90436  213993      0      0  3     0x14280  nfsidl        nfsio
 64866  464790      0      0  3     0x14280  nfsidl        nfsio
 80434  227326      0      0  3     0x14280  nfsidl        nfsio
 94490   61774      0      0  3     0x14280  nfsidl        nfsio
 59755  454654      0      0  3     0x14280  nfsidl        nfsio
 83658  496284      0      0  3     0x14280  nfsidl        nfsio
  7562  196042      0      0  3     0x14280  nfsidl        nfsio
 51710  136815      0      0  3     0x14280  nfsidl        nfsio
 82195  129073      0      0  3     0x14280  nfsidl        nfsio
 19737   40200      0      0  3     0x14280  nfsidl        nfsio
 37994  222409      0      0  3     0x14280  nfsidl        nfsio
 73781  166683      0      0  3     0x14280  nfsidl        nfsio
 93314  390954      0      0  3     0x14280  nfsidl        nfsio
 48589  215625  64175      0  2       0xc82                syz-executor
 96387  254961      1      0  3    0x100083  ttyopn        getty
 91277  243973  64175      0  3        0x82  nanoslp       syz-executor
 90320  173877  64175      0  2       0xc82                syz-executor
 98885   35196  64175      0  2       0xc82                syz-executor
 97007  512225  64175      0  3        0x82  nanoslp       syz-executor
 64175  149829  26213      0  3        0x82  kqread        syz-executor
 26213  277390  70206      0  3    0x10008a  sigsusp       ksh
 70206  256815  91761      0  3        0x98  kqread        sshd-session
 91761  305604  50103      0  3        0x92  kqread        sshd-session
 50103   19375      1      0  3        0x88  kqread        sshd
 89921  168981  96911     74  3   0x1100092  bpf           pflogd
 96911  395667      1      0  3        0x80  sbwait        pflogd
 38754  365680   5249     73  3   0x1100090  kqread        syslogd
  5249  478269      1      0  3    0x100082  sbwait        syslogd
 32201  436689      1      0  3    0x100080  kqread        resolvd
 28549  156633  43523     77  7    0x100013                dhcpleased
 90901  349678  43523     77  3    0x100092  kqread        dhcpleased
 43523  259146      1      0  3        0x80  kqread        dhcpleased
 98227  276603      0      0  3     0x14200  bored         smr
  4265  114753      0      0  2     0x14200                zerothread
 81680   32393      0      0  3     0x14200  aiodoned      aiodoned
 46600  488191      0      0  3     0x14200  syncer        update
 46430   95266      0      0  3     0x14200  cleaner       cleaner
 54804  501028      0      0  3     0x14200  reaper        reaper
  8641  399345      0      0  3     0x14200  pgdaemon      pagedaemon
 56150  250500      0      0  3     0x14200  bored         viomb
 50305  376723      0      0  3  0x40014200  acpi0         acpi0
 67179  495722      0      0  3  0x40014200                idle1
 65014  144857      0      0  3     0x14200  bored         softnet1
 79412  192734      0      0  3     0x14200  bored         softnet0
 46499  378646      0      0  3     0x14200  smrbar        systqmp
  6797  175031      0      0  3     0x14200  bored         systq
 80249  193431      0      0  3     0x14200  tmoslp        softclockmp
 17509  110157      0      0  3  0x40014200  tmoslp        softclock
 14631   36741      0      0  3  0x40014200                idle0
     1  465711      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 7042 (syz-executor) thread 0xffff80003c444800 (127973)
exclusive rrwlock inode r = 0 (0xfffffd8077c746a8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xa3 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  spec_getattr+0x8f sys/kern/spec_vnops.c:564
#6  VOP_GETATTR+0x88 sys/kern/vfs_vops.c:191
#7  fill_file+0x5dc sys/kern/kern_sysctl.c:1513
#8  sysctl_file+0x7d7 sys/kern/kern_sysctl.c:1866
#9  kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
#10 sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
#11 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#11 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
#12 Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff839c1a18)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
#2  sleep_finish+0x2d8 sys/kern/kern_synch.c:367
#3  rw_do_enter_write+0x1dc sys/kern/kern_rwlock.c:298
#4  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#5  VOP_LOCK+0xa3 sys/kern/vfs_vops.c:527
#6  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#7  spec_getattr+0x8f sys/kern/spec_vnops.c:564
#8  VOP_GETATTR+0x88 sys/kern/vfs_vops.c:191
#9  fill_file+0x5dc sys/kern/kern_sysctl.c:1513
#10 sysctl_file+0x7d7 sys/kern/kern_sysctl.c:1866
#11 kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
#12 sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
#13 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#13 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
#14 Xsyscall+0x128
Process 43868 (syz-executor) thread 0xffff80003c436028 (88207)
exclusive rwlock lockflk r = 0 (0xffffffff8384ee68)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  lf_advlock+0x227 sys/kern/vfs_lockf.c:260
#3  VOP_ADVLOCK+0x87 sys/kern/vfs_vops.c:623
#4  doopenat+0x512 sys/kern/vfs_syscalls.c:1170
#5  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
#6  Xsyscall+0x128
Process 50282 (syz-executor) thread 0xffff80003c437780 (128542)
exclusive rwlock vmmaplk r = 0 (0xfffffd806be89e78)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5171
#3  uvmspace_exec+0x1ee sys/uvm/uvm_map.c:3334
#4  sys_execve+0xc31 sys/kern/kern_exec.c:453
#5  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5  syscall+0xb17 sys/arch/amd64/amd64/trap.c:765
#6  Xsyscall+0x128
Process 46499 (systqmp) thread 0xffff8000ffffea60 (378646)
shared rwlock systqmp r = 0 (0xffffffff838559c8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10198  11170K   11495K 166960K     12426        0
            pcb    17     14K      15K 166960K       178        0
         rtable   163      8K       9K 166960K       668        0
             pf    33     17K   67485K 166960K       158        0
         ifaddr    31      5K       8K 166960K       128        0
        ifgroup    47      2K       2K 166960K       177        0
         sysctl     4      1K       9K 166960K        12        0
       counters    64     36K      37K 166960K       196        0
       ioctlops     0      0K       4K 166960K      1789        0
            iov     0      0K      16K 166960K        39        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1466     92K      93K 166960K      2481        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3      5K       9K 166960K        11        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        29        0
        dirhash    12      2K       2K 166960K        21        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     240K 166960K      1006        0
          sigio     0      0K       0K 166960K        50        0
           proc    72    115K     164K 166960K       863        0
        subproc    72      4K       4K 166960K       154        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        82        0
       in_multi    64      4K       7K 166960K       227        0
    ether_multi     1      0K       0K 166960K         6        0
            mrt     0      0K       0K 166960K         6        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     1      0K       1K 166960K       582        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   251    168K     186K 166960K     10289        0
       UVM aobj    14      2K       2K 166960K        15        0
     pinsyscall    44     88K     102K 166960K      2321        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        45        0
            NDP    10      0K       1K 166960K        86        0
           temp    54   8654K    8780K 166960K     48921        0
         kqueue    15     24K      32K 166960K       160        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      145    0      142     3     2     1     3     0     8    0
rtentry    176      218    0      155     6     0     6     6     0     8    0
unpcb      144      379    0      360     3     1     2     2     0     8    1
syncache   336        7    0        7     2     2     0     1     0     8    0
tcpqe       32        1    0        1     1     1     0     1     0     8    0
tcpcb      736      165    0      159     2     1     1     2     0     8    0
arp        136       35    0       25     1     0     1     1     0     8    0
inpcb      328      752    0      743     8     6     2     5     0     8    1
nd6        152       51    0       34     2     0     2     2     0     8    0
pkpcb       40        6    0        6     2     1     1     1     0     8    1
kcovpl      48       17    0        9     1     0     1     1     0     8    0
mppekey    1024       2    0        2     1     1     0     1     0     8    0
ppxss      1192      48    0       48     2     1     1     1     0     8    1
pppxif     1504       3    0        3     2     1     1     1     0     8    1
pfstscr     40        7    0        7     1     1     0     1     0     8    0
pffrag     232       10    0        5     1     0     1     1     0   482    0
pffrnode    88        5    0        1     1     0     1     1     0     8    0
pffrent     40       17    0       12     1     0     1     1     0     8    0
pfosfp      40     1430    0     1006     5     0     5     5     0     8    0
pfosfpen   112     1430    0      714    21     0    21    21     0     8    0
pfrktable  1344       1    0        0     1     0     1     1     0     8    0
pfstitem    24       74    0       17     1     0     1     1     0     8    0
pfstkey    128      124    0       63     2     0     2     2     0     8    0
pfstate    384       98    0       43     6     0     6     6     0     8    0
pfrule     1344      28    0       22     2     1     1     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     1025    0      689    35     8    27    31     0     8    2
art_table   40     1027    0      689     5     0     5     5     0     8    0
art_node    32      218    0      153     1     0     1     1     0     8    0
sysvmsgpl   40        8    0        4     1     0     1     1     0     8    0
semapl     112       26    0       16     1     0     1     1     0     8    0
shmpl      112       12    0        1     1     0     1     1     0     8    0
dirhash    1024      23    0        6     3     0     3     3     0     8    0
dino2pl    256     3071    0     1542    96     0    96    96     0     8    0
ffsino     296     3071    0     1542   118     0   118   118     0     8    0
nchpl      144     4245    0     2518    65     0    65    65     0     8    0
rtmask      32        7    0        7     3     2     1     1     0     8    1
vnodes     216     3828    0        0   213     0   213   213     0     8    0
namei      1024   15253    0    15252     4     2     2     2     0     8    1
percpumem   16      113    0       66     1     0     1     1     0     8    0
kstatmem   264      110    0       88     4     2     2     3     0     8    0
scsiplug    72        1    0        1     1     1     0     1     0     8    0
scxspl     216    15145    0    15145    11     8     3     7     1     8    3
plimitpl   152      249    0      231     1     0     1     1     0     8    0
sigapl     424     1281    0     1213     9     1     8     8     0     8    0
knotepl    120      545    0        0    17     0    17    17     0     8    0
kqueuepl   224      287    0      275     4     2     2     3     0     8    1
pipepl     344      215    0      187     3     0     3     3     0     8    0
fdescpl    528     1244    0     1212     3     0     3     3     0     8    0
filepl     160     7258    0     7037    19     6    13    16     0     8    2
lockfpl    104      359    0      357     1     0     1     1     0     8    0
lockfspl    48      120    0      117     1     0     1     1     0     8    0
sessionpl  144       33    0       24     1     0     1     1     0     8    0
pgrppl      48       56    0       39     1     0     1     1     0     8    0
ucredpl    104     1389    0     1376     1     0     1     1     0     8    0
zombiepl   144     1505    0     1504     2     1     1     1     0     8    0
processpl  1232    1281    0     1213     7     1     6     6     0     8    0
procpl     664     2568    0     2490     8     0     8     8     0     8    0
sosppl     176       20    0       20     2     1     1     1     0     8    1
sockpl     752     1293    0     1262    17    10     7    11     0     8    3
mcl64k     65536      7    0        0     1     0     1     1     0     8    0
mcl16k     16384      4    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl8k      8192       6    0        0     1     0     1     1     0     8    0
mcl4k      4096     114    0        0    15     0    15    15     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      32    0        0     4     0     4     4     0     8    0
mtagpl      96       18    0        0     1     0     1     1     0     8    0
mbufpl     256      220    0        0    14     0    14    14     0     8    0
bufpl      280     5150    0      142   358     0   358   358     0     8    0
anonpl      32    10758    0        0    87     0    87    87     0   246    0
amapchunkpl 152   32710    0    32148    38     4    34    34     0   158    8
amappl16   200     3389    0     3324    25     9    16    17     0     8    6
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184        8    0        8     1     1     0     1     0     8    0
amappl13   176      523    0      521     1     0     1     1     0     8    0
amappl12   168     1658    0     1616     3     0     3     3     0     8    0
amappl11   160       18    0       18     1     1     0     1     0     8    0
amappl10   152       52    0       37     1     0     1     1     0     8    0
amappl9    144      251    0      251     1     1     0     1     0     8    0
amappl8    136       28    0       25     1     0     1     1     0     8    0
amappl7    128      117    0      115     1     0     1     1     0     8    0
amappl6    120      386    0      372     1     0     1     1     0     8    0
amappl5    112       97    0       86     1     0     1     1     0     8    0
amappl4    104      458    0      429     1     0     1     1     0     8    0
amappl3     96     5831    0     5741     3     0     3     3     0     8    0
amappl2     88     1332    0     1255     2     0     2     2     0     8    0
amappl1     80    13393    0    12793    14     1    13    14     0     8    0
amappl      88     9310    0     9138     5     0     5     5     0    92    0
uvmvnodes   80     3828    0        0    79     0    79    79     0     8    0
dma16384   16384      1    0        1     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       14    0        1     1     0     1     1     0     8    0
uaddrrnd    24     1244    0     1212     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1244    0     1212     1     0     1     1     0     8    0
vmmpekpl   168    11372    0    11320     4     0     4     4     0     8    0
vmmpepl    168    84999    0    82993   100     4    96   100     0   357    3
vmsppl     488     1243    0     1212     5     0     5     5     0     8    0
rwobjpl     80    28363    0    23550    99     0    99    99     0     8    0
pdppl      4096    2496    0     2424   108    34    74    84     0     8    2
pvpl        32    17831    0        0   145     1   144   144     0   265    0
pmappl     256     1243    0     1212     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      296    0       51     8     0     8     8     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
spec_getattr(ffff80002a340428) at spec_getattr+0x9f sys/kern/spec_vnops.c:564
VOP_GETATTR(fffffd805c8b6018,ffff80002a3404a0,fffffd80097fb2d8,ffff80003c444800) at VOP_GETATTR+0x88 sys/kern/vfs_vops.c:191
fill_file(ffff8000014b6c00,fffffd806cf9b1f8,ffff8000fffeaa60,3,0,ffff800037fe9840,2a4635c6f2dd633,3,7ffffaf) at fill_file+0x5dc sys/kern/kern_sysctl.c:1513
sysctl_file(ffff80002a3408f8,4,200000000100,ffff80002a340928,ffff80003c444800) at sysctl_file+0x7d7 sys/kern/kern_sysctl.c:1866
kern_sysctl(ffff80002a3408f4,5,200000000100,ffff80002a340928,0,37,fe312a57b195de94) at kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
sys_sysctl(ffff80003c444800,ffff80002a340a60,ffff80002a3409b0) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80002a340a60) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a340a60) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x8e0bdaba0, count: -8
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299edff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839c1810) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff839c1810) at __mp_lock+0x192 sys/kern/kern_lock.c:165
ktrstruct(ffff80002a272010,ffffffff8335e221,ffff80002a2a9e80,10) at ktrstruct+0xdf sys/kern/kern_ktrace.c:313
iovec_copyin(79c5f9d68e10,ffff80002a2a9f38,ffff80002a2a9e80,1,ffff80002a2a9f30) at iovec_copyin+0x202 sys/kern/sys_generic.c:120
sys_writev(ffff80002a272010,ffff80002a2aa070,ffff80002a2a9fc0) at sys_writev+0x67 sys/kern/sys_generic.c:319
syscall(ffff80002a2aa070) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2aa070) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79c5f9d68e00, count: 6
ddb{1}> trace
x86_ipi_db(ffff8000299edff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff839c1810) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff839c1810) at __mp_lock+0x192 sys/kern/kern_lock.c:165
ktrstruct(ffff80002a272010,ffffffff8335e221,ffff80002a2a9e80,10) at ktrstruct+0xdf sys/kern/kern_ktrace.c:313
iovec_copyin(79c5f9d68e10,ffff80002a2a9f38,ffff80002a2a9e80,1,ffff80002a2a9f30) at iovec_copyin+0x202 sys/kern/sys_generic.c:120
sys_writev(ffff80002a272010,ffff80002a2aa070,ffff80002a2a9fc0) at sys_writev+0x67 sys/kern/sys_generic.c:319
syscall(ffff80002a2aa070) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2aa070) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x79c5f9d68e00, count: -9

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/27 10:29 openbsd 31b2223d374b fd2207e7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: spec_getattr
2025/10/11 03:38 openbsd ba3be980ae71 ff1712fe .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: spec_getattr
* Struck through repros no longer work on HEAD.