panic: uvm_fault_unwire_locked: address not in map (5)

Status: upstream: reported on 2025/04/02 05:45
Reported-by: syzbot+ed3d78e6268404b528d5@syzkaller.appspotmail.com
First crash: 552d, last: 1d20h
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: uvm_fault_unwire_locked: address not in map (2) 2 7 2680d 2808d 0/4 auto-closed as invalid on 2019/10/25 08:37
openbsd panic: uvm_fault_unwire_locked: address not in map 2 syz, C 2 2841d 2841d 3/4 fixed on 2019/01/11 00:09
openbsd panic: uvm_fault_unwire_locked: address not in map (4) 2 syz, C 638 570d 1646d 3/4 fixed on 2025/03/31 09:50
openbsd panic: uvm_fault_unwire_locked: address not in map (3) 2 1 1751d 1751d 3/4 fixed on 2021/12/22 03:26

Sample crash report:
login: panic: uvm_fault_unwire_locked: address not in map
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*268556  93545      0           0  0x4000000    0K syz-executor
 439241  93545      0           0  0x4000000    1  syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83519dda) at panic+0x1e5 sys/kern/subr_prf.c:198
uvm_fault_unwire_locked(ffffee007094f1f8,200000c10000,200000c19000) at uvm_fault_unwire_locked+0x4be
uvm_fault_wire(ffffee007094f1f8,200000c10000,200000c21000,1) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffffee007094f1f8,200000c10000,200000c21000,1) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff80002a22d238,200000c104c0,10000,1,ffff800035bb98a8) at uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
physio(ffffffff81a2f140,d02,0,ffffffff81a2f970,ffff800035bb9b88) at physio+0x257 sys/kern/kern_physio.c:139
spec_write(ffff800035bb99d0) at spec_write+0x11f sys/kern/spec_vnops.c:302
VOP_WRITE(ffffee006dde86d0,ffff800035bb9b88,5,ffffee00097fd3a8) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(ffffee006d18d988,ffff800035bb9b88,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:414
dofilewritev(ffff80002a22d238,5,ffff800035bb9b88,0,ffff800035bb9c40) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff80002a22d238,ffff800035bb9cf0,ffff800035bb9c40) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff800035bb9cf0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800035bb9cf0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x2a50ae74b80, count: 2
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault_unwire_locked: address not in map
ddb{0}> show kasan
No such command
ddb{0}> trace
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83519dda) at panic+0x1e5 sys/kern/subr_prf.c:198
uvm_fault_unwire_locked(ffffee007094f1f8,200000c10000,200000c19000) at uvm_fault_unwire_locked+0x4be
uvm_fault_wire(ffffee007094f1f8,200000c10000,200000c21000,1) at uvm_fault_wire+0x12d uvm_fault_unwire sys/uvm/uvm_fault.c:1724 [inline]
uvm_fault_wire(ffffee007094f1f8,200000c10000,200000c21000,1) at uvm_fault_wire+0x12d sys/uvm/uvm_fault.c:1706
uvm_vslock_device(ffff80002a22d238,200000c104c0,10000,1,ffff800035bb98a8) at uvm_vslock_device+0x112 sys/uvm/uvm_glue.c:169
physio(ffffffff81a2f140,d02,0,ffffffff81a2f970,ffff800035bb9b88) at physio+0x257 sys/kern/kern_physio.c:139
spec_write(ffff800035bb99d0) at spec_write+0x11f sys/kern/spec_vnops.c:302
VOP_WRITE(ffffee006dde86d0,ffff800035bb9b88,5,ffffee00097fd3a8) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(ffffee006d18d988,ffff800035bb9b88,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:414
dofilewritev(ffff80002a22d238,5,ffff800035bb9b88,0,ffff800035bb9c40) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff80002a22d238,ffff800035bb9cf0,ffff800035bb9c40) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff800035bb9cf0) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff800035bb9cf0) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x2a50ae74b80, count: -13
ddb{0}> show registers
rdi                                0
rsi                              0x1
rbp               0xffff800035bb95f0
rbx               0xffffffff839b0e0f    cpu_info_full_primary+0x2e0f
rdx                                0
rcx               0xffff80002a22d238
rax               0xffffffff839afff0    cpu_info_full_primary+0x1ff0
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x62674b6752de214b
r11                0xee809cfeaf89e49
r12               0xffffffff839b0c10    cpu_info_full_primary+0x2c10
r13                                0
r14                                0
r15                              0x1
rip               0xffffffff81aa9055    db_enter+0x25
cs                               0x8
rflags                         0x246
rsp               0xffff800035bb95e0
ss                                 0
db_enter+0x25:  addq    $0x8,%rsp
ddb{0}> show proc
PROC (syz-executor) tid=268556 pid=93545 tcnt=4 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=36, usrpri=66, slppri=36, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a22c2a8,0xffff80002a22c550
    process=0xffff800045feebb0 user=0xffff800035bb4000, vmspace=0xffffee007094f1f8
    estcpu=16, cpticks=11, pctcpu=0.0, user=0, sys=10, intr=1
ddb{0}> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 93545  252312  41275     0  2           0          0           syz-executor
*93545  268556  41275     0  7           0  0x4000000           syz-executor
 93545  439241  41275     0  7           0  0x4000000           syz-executor
 93545  201428  41275     0  3           0  0x4000080 fsleep    syz-executor
 25573  321300  46819     0  3         0x2       0x80 piperd    syz-executor
 23783  488184  46819     0  3         0x2       0x80 piperd    syz-executor
 16348  484533  46819     0  3         0x2       0x80 piperd    syz-executor
 85846   21410      1     0  3    0x100003       0x80 ttyin     getty
 63964   17357  46819     0  3         0x2       0x80 nanoslp   syz-executor
 74789  289304  46819     0  3         0x2       0x80 piperd    syz-executor
 42486  101915  46819     0  3         0x2       0x80 piperd    syz-executor
 41275  297344  46819     0  3         0x2       0x80 nanoslp   syz-executor
 46819  302895      1     0  3         0x2       0x80 wait      syz-executor
 17387  475030      0     0  3     0x14000      0x200 bored     smr
 22170   83148      0     0  2     0x14000      0x200           zerothread
 51366  191220      0     0  3     0x14000      0x200 aiodoned  aiodoned
 27892   40269      0     0  3     0x14000      0x200 syncer    update
 74645  436458      0     0  3     0x14000      0x200 cleaner   cleaner
  2307  453387      0     0  3     0x14000      0x200 reaper    reaper
 45245  520634      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 50145  116134      0     0  3     0x14000      0x200 bored     viomb
 98536  477141      0     0  3     0x14000 0x40000200 acpi0     acpi0
 87765  456327      0     0  3     0x14000 0x40000200           idle1
 38273  523334      0     0  3     0x14000      0x200 bored     softnet1
 17958  294966      0     0  3     0x14000      0x200 bored     softnet0
 28980  193689      0     0  3     0x14000      0x200 smrbar    systqmp
 48960  150789      0     0  3     0x14000      0x200 bored     systq
 17028  422481      0     0  3     0x14000      0x200 tmoslp    softclockmp
 17585  307338      0     0  3     0x14000 0x40000200 tmoslp    softclock
 55245  457802      0     0  3     0x14000 0x40000200           idle0
     1  107665      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb{0}> 

Crashes (222):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/04 17:11 openbsd dfaf7899c030 57bbd979 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/10/02 01:31 openbsd 573c1bf7fd16 6d32eb1f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/30 03:34 openbsd 2fa008c68904 328436b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/29 20:15 openbsd 2fa008c68904 328436b3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/29 08:07 openbsd 0049b4ffbd56 7bf4ea23 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/28 12:58 openbsd a1e6da7172db a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/28 09:05 openbsd a1e6da7172db a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/27 22:27 openbsd 95b535d85a6b a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/27 09:28 openbsd 859e3e974994 a3c7249d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/25 23:20 openbsd f1a759f91a27 0a1606bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/25 21:21 openbsd ce213f6ad10d 0a1606bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/25 06:31 openbsd 4cbfb6fe3944 0a1606bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/24 13:14 openbsd 32c50d61a433 0a1606bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/23 23:06 openbsd 0598464a2e5e 0a1606bc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/23 05:49 openbsd 6c60011d0c8d abce1216 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/23 00:04 openbsd d7f8428ad9ed 3e2106e5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/22 05:10 openbsd 4acae101ea91 e12281bd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/21 17:09 openbsd e0a25791f40f a8efa948 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/21 07:43 openbsd 920d3ffe80c9 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/20 19:37 openbsd d42776463e37 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/20 13:44 openbsd 5726aee1b375 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/18 16:19 openbsd c10aa57bf0a6 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/18 15:15 openbsd c10aa57bf0a6 853b104b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/18 11:32 openbsd 8a942bf3b779 8d7d05f1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/18 09:42 openbsd 8a942bf3b779 8d7d05f1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/17 23:32 openbsd 049788121873 4a607247 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/17 09:53 openbsd 9fbe383afb1a 95928915 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/17 01:39 openbsd 9fbe383afb1a 95928915 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/13 02:07 openbsd efac3ca090c3 70a60e12 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/10 18:45 openbsd 4385dd3101c1 1fe56c0a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/09 07:58 openbsd 9a9bc0a9ffee 8387c273 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/08 13:56 openbsd 90a01398013e 351387c4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/07 21:01 openbsd f09199d296d1 5e4626f5 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/06 16:19 openbsd 9bba88810ddf 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/05 04:23 openbsd a37481e85163 4f7b22a0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/08/30 18:10 openbsd a0938fbae2a0 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/08/30 02:56 openbsd dcba0a69dd74 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/08/29 11:29 openbsd e885dbe04d18 2f52988a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/08/28 19:36 openbsd 8fb22f705ce6 41d151d4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/08/28 17:49 openbsd 8fb22f705ce6 41d151d4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/08/28 13:55 openbsd 8fb22f705ce6 41d151d4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/08/27 16:45 openbsd eaf6a50527ed c53a1b9c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2025/12/20 07:47 openbsd ddef1afac53e e14dbeb9 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main panic: uvm_fault_unwire_locked: address not in map
2025/04/02 05:45 openbsd 60e47db49e73 c799dfdd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: uvm_fault_unwire_locked: address not in map
2026/09/10 04:14 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 0213ccb820d9 4e8b1cc6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan panic: uvm_fault_unwire_locked: address not in map
2026/09/09 10:56 https://github.com/blackgnezdo/openbsd-src.git syzbot-kasan 0213ccb820d9 8387c273 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-kasan panic: uvm_fault_unwire_locked: address not in map
* Struck through repros no longer work on HEAD.