syzbot
malloc: free list modified: UVM
Status:
upstream: reported on 2026/08/21 19:09
Reported-by: syzbot+d103698a550b6cda3ff2@syzkaller.appspotmail.com
First crash: 1d21h, last: 6h21m
Sample crash report:
ήβλΈ;Ϊ»H*CL²&+a%uκ6Ν(b<Wpanic: Data modified on freelist: word 6 of object 0xffff800001619f80 size 0x18 previous type UVM amap (0x0 != 0xdeafbead)
Starting stack trace...
panic(ffffffff834518f8) at panic+0x1ba sys/kern/subr_prf.c:229
malloc(18,62,2) at malloc+0xdb6 sys/kern/kern_malloc.c:357
amap_alloc1(22,2,0) at amap_alloc1+0x291 sys/uvm/uvm_amap.c:356
amap_copy(fffff0806d177b90,fffff08075cb5780,2,1,53455d22000,53455d22001) at amap_copy+0x257 sys/uvm/uvm_amap.c:-1
uvm_fault_check(ffff80002a783cf0,ffff80002a783d28,ffff80002a783d60,0) at uvm_fault_check+0x457 sys/uvm/uvm_fault.c:747
uvm_fault(fffff0806d177b90,53455d22000,0,1) at uvm_fault+0xe6 sys/uvm/uvm_fault.c:627
upageflttrap(ffff80002a783e90,53455d22560) at upageflttrap+0xa0 sys/arch/amd64/amd64/trap.c:194
usertrap(ffff80002a783e90) at usertrap+0x413 sys/arch/amd64/amd64/trap.c:648
recall_trap() at recall_trap+0x8
end of kernel
end trace frame: 0x75555aa5b360, count: 248
End of stack trace.
syncing disks...
* Struck through repros no longer work on HEAD.