syzbot
uvm_fault: mld6_fasttimo
Status:
upstream: reported on 2026/08/03 07:49
Reported-by: syzbot+f1e5d22909ea93b08bd4@syzkaller.appspotmail.com
First crash: 17d, last: 17d
Sample crash report:
O:Vm>7jyu18 �'J%Q Y~B"U͜8Υ5ѷۅ.((~waVR?@ Jg6E$OQ_EE 7(\-~7,ΫJF /1-S!s> m 7lJz~J V?U7[~11j @p' 'uvm_fault(0xffffffff839a60e8, 0x1, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at mld6_fasttimo+0xd4: movzbl 0x1(%rax),%r13d
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 29658 56698 0 0x14000 0x40000200 0 softclock
mld6_fasttimo() at mld6_fasttimo+0xd4 mld6_checktimer sys/netinet6/mld6.c:425 [inline]
mld6_fasttimo() at mld6_fasttimo+0xd4 sys/netinet6/mld6.c:397
pffasttimo(ffffffff83abd2a0) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff83960f40,ffffffff83abd2a0) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a6ed758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a6ed758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: 11
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839a60e8, 0x1, 0, 1) -> e
ddb> show kasan
No such command
ddb> trace
mld6_fasttimo() at mld6_fasttimo+0xd4 mld6_checktimer sys/netinet6/mld6.c:425 [inline]
mld6_fasttimo() at mld6_fasttimo+0xd4 sys/netinet6/mld6.c:397
pffasttimo(ffffffff83abd2a0) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff83960f40,ffffffff83abd2a0) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a6ed758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a6ed758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -4
ddb> show registers
rdi 0x18
rsi 0x2
rbp 0xffff80002a6f9ce0
rbx 0xffff800000c48000
rdx 0
rcx 0xffffffff83a9d960 timeout_proc
rax 0
r8 0x7f7fffffc000
r9 0
r10 0x5e83ea568a8b20a9
r11 0xa3949ed0e2f83fc0
r12 0
r13 0x2
r14 0xffff800000c59c80
r15 0xffff800000c48060
rip 0xffffffff8167b7e4 mld6_fasttimo+0xd4
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80002a6f9c90
ss 0x10
mld6_fasttimo+0xd4: movzbl 0x1(%rax),%r13d
ddb> show proc
PROC (softclock) tid=29658 pid=56698 tcnt=1 stat=onproc
flags process=14000<NOZOMBIE,SYSTEM> proc=40000200<SYSTEM,CPUPEG>
runpri=0, usrpri=51, slppri=0, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a6ed9f0,0xffff80002a6ed4d0
process=0xffff800045fff180 user=0xffff80002a6f4000, vmspace=0xffffffff839a60e8
estcpu=1, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
16629 417000 31489 0 2 0 0 syz-executor
16629 204534 31489 0 2 0 0x4000000 syz-executor
24985 356934 31618 0 2 0 0 syz-executor
24985 115133 31618 0 2 0 0x4000000 syz-executor
91170 397077 97420 0 2 0 0 syz-executor
91170 240665 97420 0 3 0 0x4000088 kqpoll syz-executor
91170 46639 97420 0 3 0 0x4000080 fsleep syz-executor
89277 143996 23201 0 2 0 0xc80 syz-executor
89277 64936 23201 0 3 0 0x4000080 kqsel syz-executor
89277 365350 23201 0 3 0 0x4000080 fsleep syz-executor
2236 177265 4773 -1 3 0x11 0x80 nanoslp syz-executor
2236 7322 4773 -1 3 0x11 0x4000080 sbwait syz-executor
2236 211274 4773 -1 3 0x11 0x4000080 fsleep syz-executor
77719 260739 39827 0 2 0 0xc80 syz-executor
77719 443278 39827 0 3 0 0x4000080 kqread syz-executor
77719 476427 39827 0 3 0 0x4000080 fsleep syz-executor
77719 27200 39827 0 3 0 0x4000080 fsleep syz-executor
61331 462474 0 0 3 0x14000 0x280 nfsidl nfsio
78382 367604 0 0 3 0x14000 0x280 nfsidl nfsio
17922 234898 0 0 3 0x14000 0x280 nfsidl nfsio
78400 118310 0 0 3 0x14000 0x280 nfsidl nfsio
31289 215451 0 0 3 0x14000 0x280 nfsidl nfsio
2092 282015 0 0 3 0x14000 0x280 nfsidl nfsio
16283 302538 0 0 3 0x14000 0x280 nfsidl nfsio
85424 122745 0 0 3 0x14000 0x280 nfsidl nfsio
89559 443896 0 0 3 0x14000 0x280 nfsidl nfsio
98856 459862 0 0 3 0x14000 0x280 nfsidl nfsio
98536 410405 0 0 3 0x14000 0x280 nfsidl nfsio
43673 47678 0 0 3 0x14000 0x280 nfsidl nfsio
27524 251830 0 0 3 0x14000 0x280 nfsidl nfsio
2180 180395 0 0 3 0x14000 0x280 nfsidl nfsio
79657 206479 0 0 3 0x14000 0x280 nfsidl nfsio
69624 294183 0 0 3 0x14000 0x280 nfsidl nfsio
59182 401194 0 0 3 0x14000 0x280 nfsidl nfsio
70982 433124 0 0 3 0x14000 0x280 nfsidl nfsio
2660 146426 0 0 3 0x14000 0x280 nfsidl nfsio
8040 483546 0 0 3 0x14000 0x280 nfsidl nfsio
4749 335811 1 0 3 0x100003 0x80 ttyin getty
39827 213518 34810 0 2 0x2 0 syz-executor
4773 372402 34810 0 2 0x2 0xc80 syz-executor
48060 491361 34810 0 2 0x2 0xc80 syz-executor
31489 271678 34810 0 2 0x2 0xc80 syz-executor
97420 394842 34810 0 3 0x2 0x80 nanoslp syz-executor
27684 111565 34810 0 3 0x2 0x80 wait syz-executor
23201 402147 34810 0 3 0x2 0x80 nanoslp syz-executor
31618 67797 34810 0 3 0x2 0x80 nanoslp syz-executor
34810 265094 1 0 3 0x2 0x80 kqread syz-executor
15783 196906 1 73 3 0x1100010 0x80 kqread syslogd
11050 350601 0 0 3 0x14000 0x200 bored smr
57214 281642 0 0 2 0x14000 0x200 zerothread
29154 133058 0 0 3 0x14000 0x200 aiodoned aiodoned
26128 428032 0 0 3 0x14000 0x200 syncer update
16734 494315 0 0 3 0x14000 0x200 cleaner cleaner
22616 276283 0 0 3 0x14000 0x200 reaper reaper
56508 10111 0 0 3 0x14000 0x200 pgdaemon pagedaemon
6572 520851 0 0 3 0x14000 0x200 bored viomb
54371 160170 0 0 3 0x14000 0x40000200 acpi0 acpi0
92190 351945 0 0 3 0x14000 0x200 bored softnet0
58900 172059 0 0 3 0x14000 0x200 bored systqmp
45498 59967 0 0 3 0x14000 0x200 bored systq
*56698 29658 0 0 7 0x14000 0x40000200 softclock
87318 4929 0 0 3 0x14000 0x40000200 idle0
1 44900 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11037 12133K 13813K 166960K 12924 0
pcb 17 16K 22K 166960K 299 0
rtable 258 9K 10K 166960K 408 0
pf 31 13K 19K 166960K 61 0
ifaddr 44 8K 8K 166960K 55 0
ifgroup 50 2K 2K 166960K 65 0
sysctl 1 1K 9K 166960K 6 0
counters 33 17K 18K 166960K 44 0
ioctlops 0 0K 4K 166960K 72 0
iov 0 0K 16K 166960K 9 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1453 91K 92K 166960K 1790 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 6 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 0K 166960K 79 0
dirhash 12 2K 2K 166960K 15 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 18 65K 93K 166960K 401 0
proc 20 25K 83K 166960K 546 0
subproc 72 4K 4K 166960K 73 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 33 0
in_multi 107 7K 7K 166960K 115 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 14 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 73 334K 334K 166960K 73 0
exec 0 0K 1K 166960K 383 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 162 83K 156K 166960K 5159 0
UVM aobj 77 3K 3K 166960K 78 0
pinsyscall 22 44K 98K 166960K 1505 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 10 0
NDP 11 0K 2K 166960K 33 0
temp 42 9111K 9127K 166960K 22610 0
kqueue 6 10K 27K 166960K 88 0
SYN cache 2 16K 24K 166960K 3 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 48 0 48 1 0 1 1 0 8 1
rtentry 136 120 0 6 4 0 4 4 0 8 0
unpcb 144 142 0 134 1 0 1 1 0 8 0
syncache 336 11 0 11 2 1 1 1 0 8 1
tcpqe 32 2 0 2 1 1 0 1 0 8 0
tcpcb 736 82 0 79 2 0 2 2 0 8 1
arp 96 18 0 0 1 0 1 1 0 8 0
inpcb 328 460 0 454 6 0 6 6 0 8 4
nd6 112 28 0 2 1 0 1 1 0 8 0
pkpcb 40 1 0 1 1 1 0 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
ppxss 1072 10 0 10 1 0 1 1 0 8 1
pppxif 1416 1 0 1 1 1 0 1 0 8 0
pfstscr 40 2 0 0 1 0 1 1 0 8 0
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 1 0 0 1 0 1 1 0 8 0
pfrktable 1344 6 0 5 1 0 1 1 0 8 0
pfsrclim 320 1 0 1 1 0 1 1 0 8 1
pfanchor 1288 1 0 1 1 0 1 1 0 8 1
pftag 88 4 0 2 1 0 1 1 0 8 0
pfstitem 24 2 0 0 1 0 1 1 0 8 0
pfstkey 128 2 0 0 1 0 1 1 0 8 0
pfstate 384 1 0 0 1 0 1 1 0 8 0
pfrule 1360 5 0 4 1 0 1 1 0 8 0
rttmr 136 1 0 1 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 471 0 16 30 0 30 30 0 8 0
art_table 40 472 0 16 5 0 5 5 0 8 0
art_node 32 120 0 17 1 0 1 1 0 8 0
sysvmsgpl 40 3 0 1 1 0 1 1 0 8 0
semupl 112 1 0 1 1 0 1 1 0 8 1
semapl 72 76 0 66 1 0 1 1 0 8 0
shmpl 112 75 0 1 3 0 3 3 0 8 0
dirhash 1024 19 0 2 3 0 3 3 0 8 0
dino2pl 256 2063 0 603 92 0 92 92 0 8 0
ffsino 256 2063 0 603 92 0 92 92 0 8 0
nchpl 144 2620 0 921 64 0 64 64 0 8 0
rtmask 32 3 0 3 1 0 1 1 0 8 1
vnodes 216 2474 0 0 138 0 138 138 0 8 0
namei 1024 8050 0 8050 3 2 1 1 0 8 1
pfiaddrpl 120 1 0 1 1 0 1 1 0 8 1
kstatmem 264 35 0 12 2 0 2 2 0 8 0
scsiplug 72 1 0 1 1 1 0 1 0 8 0
scxspl 216 9930 0 9930 8 7 1 8 1 8 1
plimitpl 152 56 0 45 1 0 1 1 0 8 0
sigapl 424 717 0 663 8 1 7 7 0 8 0
knotepl 120 13464 0 13191 24 14 10 17 0 8 1
kqueuepl 184 158 0 150 4 3 1 4 0 8 0
pipepl 304 202 0 174 3 0 3 3 0 8 0
fdescpl 448 684 0 663 5 1 4 5 0 8 0
filepl 120 3625 0 3431 14 1 13 13 0 8 5
lockfpl 104 359 0 359 2 0 2 2 0 8 2
lockfspl 48 106 0 106 1 0 1 1 0 8 1
sessionpl 144 36 0 30 1 0 1 1 0 8 0
pgrppl 48 50 0 36 1 0 1 1 0 8 0
ucredpl 104 347 0 340 1 0 1 1 0 8 0
zombiepl 144 665 0 663 2 1 1 1 0 8 0
processpl 1152 717 0 663 4 0 4 4 0 8 0
procpl 664 1127 0 1062 7 1 6 6 0 8 0
sosppl 176 1 0 1 1 0 1 1 0 8 1
sockpl 552 732 0 717 6 0 6 6 0 8 3
mcl64k 65536 25 0 24 3 2 1 1 0 8 0
mcl16k 16384 4 0 4 2 1 1 1 0 8 1
mcl12k 12288 1 0 1 1 1 0 1 0 8 0
mcl8k 8192 12 0 12 2 1 1 1 0 8 1
mcl4k 4096 2903 0 2853 15 7 8 14 0 8 1
mcl2k 2048 294 0 294 1 0 1 1 0 8 1
mextrefs 64 154 0 154 1 0 1 1 0 8 1
mtagpl 96 4 0 4 1 1 0 1 0 8 0
mbufpl 256 7061 0 6882 27 8 19 27 0 8 7
bufpl 272 3464 0 105 224 0 224 224 0 8 0
anonpl 24 135091 0 133058 64 12 52 52 0 187 29
amapchunkpl 152 17372 0 16943 35 8 27 28 0 158 7
amappl16 200 2164 0 2141 20 3 17 17 0 8 14
amappl15 192 9 0 9 2 1 1 1 0 8 1
amappl14 184 411 0 411 1 0 1 1 0 8 1
amappl13 176 119 0 117 1 0 1 1 0 8 0
amappl12 168 935 0 915 2 0 2 2 0 8 0
amappl11 160 5 0 5 1 1 0 1 0 8 0
amappl10 152 78 0 75 1 0 1 1 0 8 0
amappl9 144 276 0 276 1 1 0 1 0 8 0
amappl8 136 93 0 93 1 0 1 1 0 8 1
amappl7 128 141 0 137 1 0 1 1 0 8 0
amappl6 120 148 0 148 1 0 1 1 0 8 1
amappl5 112 90 0 88 1 0 1 1 0 8 0
amappl4 104 262 0 256 1 0 1 1 0 8 0
amappl3 96 3151 0 3057 3 0 3 3 0 8 0
amappl2 88 523 0 508 2 0 2 2 0 8 0
amappl1 80 11272 0 11112 14 2 12 14 0 8 1
amappl 88 4424 0 4282 4 0 4 4 0 92 0
uvmvnodes 80 109 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 1 0 1 0 8 0
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 1 0 1 0 8 0
dma128 128 254 0 254 2 2 0 1 0 8 0
dma64 64 6 0 6 1 1 0 1 0 8 0
dma32 32 7 0 7 1 1 0 1 0 8 0
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 77 0 1 2 0 2 2 0 8 0
uaddrrnd 24 684 0 663 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 684 0 663 1 0 1 1 0 8 0
vmmpekpl 168 7460 0 7425 2 0 2 2 0 8 0
vmmpepl 168 51433 0 50422 81 1 80 81 0 357 31
vmsppl 368 683 0 663 4 1 3 4 0 8 0
rwobjpl 40 17251 0 16672 11 0 11 11 0 8 0
pdppl 4096 1374 0 1326 98 50 48 80 0 8 0
pvpl 32 339891 0 334049 124 21 103 104 0 265 39
pmappl 216 683 0 663 3 0 3 3 0 8 0
extentpl 40 46 0 28 1 0 1 1 0 8 0
phpool 112 610 0 76 16 0 16 16 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
mld6_fasttimo() at mld6_fasttimo+0xd4 mld6_checktimer sys/netinet6/mld6.c:425 [inline]
mld6_fasttimo() at mld6_fasttimo+0xd4 sys/netinet6/mld6.c:397
pffasttimo(ffffffff83abd2a0) at pffasttimo+0x184 sys/kern/uipc_domain.c:-1
timeout_run(ffffffff83960f40,ffffffff83abd2a0) at timeout_run+0xf3 sys/kern/kern_timeout.c:-1
softclock_thread(ffff80002a6ed758) at softclock_thread+0x12b softclock_thread_run sys/kern/kern_timeout.c:842 [inline]
softclock_thread(ffff80002a6ed758) at softclock_thread+0x12b sys/kern/kern_timeout.c:866
end trace frame: 0x0, count: -4
ddb> machine ddbcpu 1
No such command
ddb>
Struck through repros no longer work on HEAD.