syzbot
uvm_fault: ifiq_enqueue_qlim
Status:
upstream: reported on 2026/07/28 20:25
Reported-by: syzbot+ee424ec1e507e1e118b3@syzkaller.appspotmail.com
First crash: 29d, last: 2d07h
Sample crash report:
uvm_fault(0xffffffff839d5cd0, 0xee01, 0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff82656f79 cs 8 rflags 10246 cr2 ee01 cpl 0 rsp ffff80002a70b0e0
gsbase 0xffffffff8399cff0 kgsbase 0x0
panic: trap type 6, code=0, pc=ffffffff82656f79
Starting stack trace...
panic(ffffffff834be6b9) at panic+0x1ba sys/kern/subr_prf.c:229
kerntrap(ffff80002a70b030) at kerntrap+0x2fb
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
ifiq_enqueue_qlim(ee01,fffff5006f936700,2000) at ifiq_enqueue_qlim+0x39 sys/net/ifq.c:800
if_output_local(ffff800000c48000,fffff5006f936700,2) at if_output_local+0xae sys/net/if.c:1011
if_output_tso(ffff800000c48000,ffff80002a70b2f0,ffff80002a70b240,fffff5007204f660,8000) at if_output_tso+0x200 sys/net/if.c:-1
ip_output(fffff5006f936700,0,0,0,0,0,6e5cf19df8dee455) at ip_output+0x107e sys/netinet/ip_output.c:437
ip_send_do_dispatch(ffffffff839ddd58,0) at ip_send_do_dispatch+0x128 sys/netinet/ip_input.c:1960
taskq_thread(ffff80000002c000) at taskq_thread+0xe4 sys/kern/kern_task.c:446
end trace frame: 0x0, count: 248
End of stack trace.
* Struck through repros no longer work on HEAD.