panic: malloc: allocation too large, type = NUM, size = ADDR (5)

Status: fixed on 2025/08/01 13:35
Reported-by: syzbot+eef7ac9dfe338eeaec7c@syzkaller.appspotmail.com
Fix commit: 753a922a6fb4 Set the upper boundary of 'kern.seminfo.semopm' variable to "(MALLOC_MAX / sizeof(struct sembuf))". Otherwise the greater value could exceed the MALLOC_MAX limit and cause panic.
First crash: 383d, last: 383d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd panic: malloc: allocation too large, type = NUM, size = ADDR (4) 2 22 452d 550d 0/4 auto-obsoleted due to no activity on 2025/07/19 04:01
openbsd panic: malloc: allocation too large, type = NUM, size = ADDR (2) 2 126 629d 718d 0/4 auto-obsoleted due to no activity on 2025/01/09 10:32
openbsd panic: malloc: allocation too large, type = NUM, size = ADDR (3) 2 58 551d 553d 3/4 fixed on 2025/02/06 06:14
openbsd panic: malloc: allocation too large, type = NUM, size = ADDR 2 syz, C 3 1699d 1700d 3/4 fixed on 2021/12/21 15:21

Sample crash report:
panic: malloc: allocation too large, type = 31, size = 4294970604
Starting stack trace...
panic(ffffffff833a1150) at panic+0x1d0 sys/kern/subr_prf.c:229
malloc(100000cec,1f,1) at malloc+0xcf4 sys/kern/kern_malloc.c:334
sys_semop(ffff80002a34e7e8,ffff80003c4b6fe0,ffff80003c4b6f30) at sys_semop+0x234 sys/kern/sysv_sem.c:564
syscall(ffff80003c4b6fe0) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4b6fe0) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x460f14918a0, count: 252
End of stack trace.



OpenBSD/amd64 (Amnesiac) (tty00)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/24 00:38 openbsd ceb7068b172a 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore panic: malloc: allocation too large, type = NUM, size = ADDR
* Struck through repros no longer work on HEAD.