syzbot


uvm_fault: softclock (6)

Status: upstream: reported on 2026/05/19 20:08
Reported-by: syzbot+da9c5223d70f4e23edb2@syzkaller.appspotmail.com
First crash: 1d04h, last: 1d04h
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: softclock (5) -1 1 625d 625d 0/3 auto-obsoleted due to no activity on 2024/12/01 02:13
openbsd uvm_fault: softclock (3) -1 1 1000d 1000d 0/3 auto-obsoleted due to no activity on 2023/11/22 14:27
openbsd uvm_fault: softclock -1 1 1309d 1309d 0/3 auto-obsoleted due to no activity on 2023/01/17 03:44
openbsd uvm_fault: softclock (4) -1 9 775d 806d 0/3 auto-obsoleted due to no activity on 2024/07/04 14:38
openbsd uvm_fault: softclock (2) -1 2 1169d 1181d 0/3 auto-obsoleted due to no activity on 2023/06/06 21:13

Sample crash report:
uvm_fault(0xfffffd8072a58e68, 0x8, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      softclock+0xe7: movq    %rcx,0x8(%rax)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*208479  22862      0           0  0x4000000    0  syz-executor
softclock(0) at softclock+0xe7 sys/kern/kern_timeout.c:784
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
buf_get(0,0,ffd000) at buf_get+0x5de sys/kern/vfs_bio.c:1170
geteblk(ffd000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff8111d460,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d01,84946467,ffff8000015bd000,3,ffff8000338ca2b8) at sdioctl+0x959 sys/scsi/sd.c:919
VOP_IOCTL(fffffd8068c926e0,84946467,ffff8000015bd000,3,fffffd8007ffd548,ffff8000338ca2b8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806a5fb350,84946467,ffff8000015bd000,ffff8000338ca2b8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff8000338ca2b8,ffff80003c909cd0,ffff80003c909c20) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c909cd0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c909cd0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x370a7f1aef0, count: 2
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd8072a58e68, 0x8, 0, 2) -> e
ddb> trace
softclock(0) at softclock+0xe7 sys/kern/kern_timeout.c:784
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
buf_get(0,0,ffd000) at buf_get+0x5de sys/kern/vfs_bio.c:1170
geteblk(ffd000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff8111d460,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d01,84946467,ffff8000015bd000,3,ffff8000338ca2b8) at sdioctl+0x959 sys/scsi/sd.c:919
VOP_IOCTL(fffffd8068c926e0,84946467,ffff8000015bd000,3,fffffd8007ffd548,ffff8000338ca2b8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806a5fb350,84946467,ffff8000015bd000,ffff8000338ca2b8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff8000338ca2b8,ffff80003c909cd0,ffff80003c909c20) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c909cd0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c909cd0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x370a7f1aef0, count: -13
ddb> show registers
rdi                       0xffffffff
rsi                              0xd
rbp               0xffff80003c909570
rbx                              0x1
rdx               0xffff8000015e5dc0
rcx               0xffffffff839facb0    timeout_todo
rax                                0
r8                0xffff80002ecb3ce8
r9                              0x21
r10               0xbc566252879f80b6
r11               0x36db93be989fe534
r12                       0xffffffff
r13               0xffffffff83a5f6f0    rdrand_tmo
r14                                0
r15               0xffff80002a767d30
rip               0xffffffff81e72427    softclock+0xe7
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80003c909530
ss                              0x10
softclock+0xe7: movq    %rcx,0x8(%rax)
ddb> show proc
PROC (syz-executor) tid=208479 pid=22862 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=77, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000338ca7e8,0xffff80002d8b0a88
    process=0xffff8000ffffa898 user=0xffff80003c904000, vmspace=0xfffffd8072a58e68
    estcpu=27, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  2487  453915      0      0  2           0                syz-executor
  2487   79381      0      0  3   0x4000080  kqread        syz-executor
 22862  340291      0      0  2           0                syz-executor
*22862  208479      0      0  7   0x4000000                syz-executor
 22862  218284      0      0  3   0x4000080  fsleep        syz-executor
 53880  300701  57952      0  2           0                syz-executor
 53880  265940  57952      0  3   0x4000080  netcon        syz-executor
 81350  182066  37656      0  2           0                syz-executor
 81350  160949  37656      0  3   0x4000080  semwait       syz-executor
 22288  310857      0      0  2           0                syz-executor
 22288  212155      0      0  3   0x4000080  tunread       syz-executor
 96136  517578  12544      0  2           0                syz-executor
 96136  315499  12544      0  3   0x4000080  fsleep        syz-executor
  5966  265435  19257      0  2       0xc80                syz-executor
  5966  151704  19257      0  2   0x4000c80                syz-executor
  5966  462667  19257      0  3   0x4000080  fsleep        syz-executor
 19257  184326      0      0  2       0xc82                syz-executor
 12544  113615      0      0  3        0x82  nanoslp       syz-executor
 30037   13723      1      0  3    0x100083  ttyin         getty
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11039  12108K   12460K 166960K     12846        0
            pcb    17     12K      12K 166960K       103        0
         rtable   212      7K       7K 166960K       541        0
             pf    36     14K      19K 166960K       127        0
         ifaddr    39      6K       7K 166960K        68        0
        ifgroup    55      2K       2K 166960K        84        0
         sysctl     4      1K       9K 166960K        10        0
       counters    34     17K      17K 166960K        43        0
       ioctlops     1      2K       4K 166960K       243        0
            iov     0      0K       8K 166960K        20        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1357     85K      85K 166960K      2127        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         7        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        26        0
        dirhash    12      2K       2K 166960K        12        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K      85K 166960K       651        0
          sigio     0      0K       0K 166960K         4        0
           proc    29     49K      83K 166960K       692        0
        subproc    72      4K       4K 166960K       108        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        54        0
       in_multi    85      6K       7K 166960K       171        0
    ether_multi     1      0K       0K 166960K         8        0
            mrt     0      0K       0K 166960K        20        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    73    334K     334K 166960K        73        0
           exec     0      0K       1K 166960K       464        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   198    133K     163K 166960K      7028        0
       UVM aobj     4      2K       2K 166960K         4        0
     pinsyscall    34     68K      90K 166960K      1840        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        11        0
            NDP    14      0K       2K 166960K        46        0
           temp    48   9108K    9172K 166960K     18172        0
         kqueue    14     22K      27K 166960K       106        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       64    0       62     1     0     1     1     0     8    0
rtentry    136      165    0       75     4     0     4     4     0     8    0
unpcb      144      441    0      427     6     0     6     6     0     8    5
syncache   336        4    0        4     1     1     0     1     0     8    0
tcpcb      736      178    0      173     4     0     4     4     0     8    3
arp         96       26    0       10     1     0     1     1     0     8    0
inpcb      328      525    0      515     7     0     7     7     0     8    5
nd6        112       38    0       16     1     0     1     1     0     8    0
pkpcb       40        1    0        1     1     1     0     1     0     8    0
kcovpl      48       12    0        4     1     0     1     1     0     8    0
ppxss      1072       3    0        3     1     1     0     1     0     8    0
pfstscr     40        3    0        0     1     0     1     1     0     8    0
pffrag     232        3    0        0     1     0     1     1     0   482    0
pffrnode    88        3    0        0     1     0     1     1     0     8    0
pffrent     40        3    0        0     1     0     1     1     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pfsrclim   320        1    0        1     1     1     0     1     0     8    0
pfstlim    224        1    0        1     1     0     1     1     0     8    1
pfanchor   1288       2    0        0     1     0     1     1     0     8    0
pfstitem    24        5    0        0     1     0     1     1     0     8    0
pfstkey    128        6    0        1     1     0     1     1     0     8    0
pfstate    384        4    0        1     1     0     1     1     0     8    0
pfrule     1360       7    0        7     3     2     1     1     0     8    1
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      708    0      310    31     5    26    29     0     8    1
art_table   40      710    0      310     5     0     5     5     0     8    0
art_node    32      163    0       83     1     0     1     1     0     8    0
sysvmsgpl   40        8    0        6     1     0     1     1     0     8    0
semapl      64       21    0       11     1     0     1     1     0     8    0
shmpl      112        1    0        0     1     0     1     1     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dirhash: pool(0xffffffff839c7df8:dirhash): free list modified: page 0xffff80002a778000; item ordinal 0; addr 0xffff80002a778000 (p 0xfffffd806ea84000); offset 0x0=0x0
pool(dirhash): free list modified: page 0xffff80002a778000; item ordinal 0; addr 0xffff80002a778000 (p 0xfffffd806ea84000); offset 0x0=0x0
dirhash: pool(0xffffffff839c7df8:dirhash): page inconsistency: page 0xffff80002a778000; item ordinal 1; addr 0x857031c68ace2797
dino2pl    256     2544    0     1078    92     0    92    92     0     8    0
ffsino     256     2544    0     1078    92     0    92    92     0     8    0
nchpl      144     3427    0     1716    64     0    64    64     0     8    0
vnodes     216     3120    0        0   174     0   174   174     0     8    0
namei      1024   11550    0    11550     2     1     1     2     0     8    1
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
kstatmem   264       41    0       16     2     0     2     2     0     8    0
scsiplug    72        1    0        1     1     1     0     1     0     8    0
scxspl     216    16713    0    16713    10     9     1     8     1     8    1
plimitpl   152      155    0      139     1     0     1     1     0     8    0
sigapl     424      934    0      894     6     1     5     6     0     8    0
knotepl    120    30674    0    30617    40    25    15    16     0     8   11
kqueuepl   184      131    0      121     1     0     1     1     0     8    0
pipepl     304      155    0      127     3     0     3     3     0     8    0
fdescpl    448      921    0      894     4     0     4     4     0     8    0
filepl     120     5316    0     5096    15     2    13    13     0     8    4
lockfpl    104      293    0      291     2     1     1     2     0     8    0
lockfspl    48      140    0      138     1     0     1     1     0     8    0
sessionpl  144      104    0       97     1     0     1     1     0     8    0
pgrppl      48      120    0      105     1     0     1     1     0     8    0
ucredpl    104      939    0      929     1     0     1     1     0     8    0
zombiepl   144      945    0      944     1     0     1     1     0     8    0
processpl  1152     934    0      894     4     0     4     4     0     8    0
processpl: pool(0xffffffff8399e840:processpl): page inconsistency: page 0x0; at page head addr 0xffff80002a747f90 (p 0xffff80002a744000)
procpl     664     1612    0     1563     5     0     5     5     0     8    0
procpl: pool(0xffffffff8399e688:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a6edf90 (p 0xffff80002a6ec000)
procpl: pool(0xffffffff8399e688:procpl): page inconsistency: page 0x0; at page head addr 0xffff80002a767f90 (p 0xffff80002a766000)
sosppl     176        3    0        3     2     1     1     1     0     8    1
sockpl     552     1048    0     1022    13     1    12    12     0     8    9
mcl64k     65536     31    0       31     3     2     1     1     0     8    1
mcl16k     16384      9    0        9     1     1     0     1     0     8    0
mcl12k     12288      4    0        4     2     2     0     1     0     8    0
mcl9k128   9344       1    0        1     1     1     0     1     0     8    0
mcl8k      8192      13    0       13     3     2     1     1     0     8    1
mcl4k      4096    3190    0     3132    17     8     9    15     0     8    0
mcl2k2     2112       1    0        1     1     0     1     1     0     8    1
mcl2k      2048     683    0      682     4     1     3     3     0     8    2
mtagpl      96        9    0        4     1     0     1     1     0     8    0
mbufpl     256    10914    0    10761    75     1    74    74     0     8   59
bufpl      280     6298    0      103   443     0   443   443     0     8    0
anonpl      24   162213    0   159025    89    14    75    75     0   186   31
amapchunkpl 152   22955    0    22510    40    14    26    34     0   158    8
amappl16   200     3403    0     3355    33    17    16    26     0     8    8
amappl15   192        5    0        5     1     1     0     1     0     8    0
amappl14   184      465    0      465     3     2     1     1     0     8    1
amappl13   176      156    0      147     1     0     1     1     0     8    0
amappl12   168     1172    0     1146     2     0     2     2     0     8    0
amappl11   160       93    0       93     1     1     0     1     0     8    0
amappl10   152       59    0       51     1     0     1     1     0     8    0
amappl9    144      257    0      257     1     1     0     1     0     8    0
amappl8    136      113    0      113     3     2     1     1     0     8    1
amappl7    128      152    0      143     1     0     1     1     0     8    0
amappl6    120      202    0      201     1     0     1     1     0     8    0
amappl5    112       88    0       82     1     0     1     1     0     8    0
amappl4    104      266    0      254     1     0     1     1     0     8    0
amappl3     96     4506    0     4403     3     0     3     3     0     8    0
amappl2     88      549    0      501     2     0     2     2     0     8    0
amappl1     80    11350    0    10866    12     0    12    12     0     8    0
amappl      88     6182    0     6035     4     0     4     4     0    92    0
uvmvnodes   80      130    0        0     3     0     3     3     0     8    0
dma16384   16384      1    0        1     1     0     1     1     0     8    1
dma4096    4096       2    0        2     2     2     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72        3    0        0     1     0     1     1     0     8    0
uaddrrnd    24      921    0      894     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      921    0      894     1     0     1     1     0     8    0
vmmpekpl   168     8308    0     8252     3     0     3     3     0     8    0
vmmpepl    168    64881    0    63217    99     6    93    93     0   357   16
vmsppl     368      920    0      894     4     1     3     4     0     8    0
rwobjpl     40    19986    0    19093    15     1    14    14     0     8    0
pdppl      4096    1848    0     1788   100    38    62    76     0     8    2
pvpl        32   418198    0   409181   162    21   141   141     0   265   39
pmappl     216      920    0      894     2     0     2     2     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      446    0       66    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
softclock(0) at softclock+0xe7 sys/kern/kern_timeout.c:784
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
buf_get(0,0,ffd000) at buf_get+0x5de sys/kern/vfs_bio.c:1170
geteblk(ffd000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff8111d460,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d01,84946467,ffff8000015bd000,3,ffff8000338ca2b8) at sdioctl+0x959 sys/scsi/sd.c:919
VOP_IOCTL(fffffd8068c926e0,84946467,ffff8000015bd000,3,fffffd8007ffd548,ffff8000338ca2b8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806a5fb350,84946467,ffff8000015bd000,ffff8000338ca2b8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff8000338ca2b8,ffff80003c909cd0,ffff80003c909c20) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c909cd0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c909cd0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x370a7f1aef0, count: -13
ddb> machine ddbcpu 1
No such command
ddb> trace
softclock(0) at softclock+0xe7 sys/kern/kern_timeout.c:784
softintr_dispatch(0) at softintr_dispatch+0xf9 sys/kern/kern_softintr.c:87
dosoftint(0) at dosoftint+0x48 sys/arch/amd64/amd64/intr.c:862
Xsoftclock() at Xsoftclock+0x27
buf_get(0,0,ffd000) at buf_get+0x5de sys/kern/vfs_bio.c:1170
geteblk(ffd000) at geteblk+0x3c sys/kern/vfs_bio.c:-1
writedisklabel(d02,ffffffff8111d460,ffff800000039000) at writedisklabel+0x4b sys/arch/amd64/amd64/disksubr.c:133
sdioctl(d01,84946467,ffff8000015bd000,3,ffff8000338ca2b8) at sdioctl+0x959 sys/scsi/sd.c:919
VOP_IOCTL(fffffd8068c926e0,84946467,ffff8000015bd000,3,fffffd8007ffd548,ffff8000338ca2b8) at VOP_IOCTL+0xa3 sys/kern/vfs_vops.c:264
vn_ioctl(fffffd806a5fb350,84946467,ffff8000015bd000,ffff8000338ca2b8) at vn_ioctl+0xea sys/kern/vfs_vnops.c:537
sys_ioctl(ffff8000338ca2b8,ffff80003c909cd0,ffff80003c909c20) at sys_ioctl+0x660 sys/kern/sys_generic.c:-1
syscall(ffff80003c909cd0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c909cd0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x370a7f1aef0, count: -13

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/19 20:07 openbsd 3fe334830a75 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: softclock
* Struck through repros no longer work on HEAD.