syzbot
uvm_fault: udv_detach
Status:
upstream: reported on 2026/09/05 01:08
Reported-by: syzbot+f797ae232118cd04815b@syzkaller.appspotmail.com
First crash: 14d, last: 14d
Sample crash report:
uvm_fault(0xfffffc00720bd2e8, 0x100000072, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at udv_detach+0x164: movq %r15,0x30(%r12)
TID PID UID PRFLAGS PFLAGS CPU COMMAND
*468094 7066 0 0x1044 0 0 syz-executor
udv_detach(ffff8000015e45c0) at udv_detach+0x164 sys/uvm/uvm_device.c:275
uvm_unmap_detach(ffff80003c8f0c88,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1370
uvmspace_exec(ffff80002a75dca0,1000,7f7fffffc000) at uvmspace_exec+0x451 sys/uvm/uvm_map.c:3404
sys_execve(ffff80002a75dca0,ffff80003c8f1330,ffff80003c8f1280) at sys_execve+0xfe8 sys/kern/kern_exec.c:517
syscall(ffff80003c8f1330) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c8f1330) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ec6bb1c30, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffc00720bd2e8, 0x100000072, 0, 2) -> e
ddb> show kasan
No such command
ddb> trace
udv_detach(ffff8000015e45c0) at udv_detach+0x164 sys/uvm/uvm_device.c:275
uvm_unmap_detach(ffff80003c8f0c88,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1370
uvmspace_exec(ffff80002a75dca0,1000,7f7fffffc000) at uvmspace_exec+0x451 sys/uvm/uvm_map.c:3404
sys_execve(ffff80002a75dca0,ffff80003c8f1330,ffff80003c8f1280) at sys_execve+0xfe8 sys/kern/kern_exec.c:517
syscall(ffff80003c8f1330) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c8f1330) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ec6bb1c30, count: -6
ddb> show registers
rdi 0
rsi 0
rbp 0xffff80003c8f0c00
rbx 0xffffffff81b25f50 udv_detach
rdx 0
rcx 0xffff80003c8f0c88
rax 0xffff80002a75dca0
r8 0
r9 0xffff80003c8f0ab0
r10 0xf145dd14d8c21e44
r11 0x73261f2f807b6988
r12 0x100000042
r13 0xffff8000015e45c0
r14 0xffff8000015e45c0
r15 0x798e2651
rip 0xffffffff81b260b4 udv_detach+0x164
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80003c8f0bd0
ss 0x10
udv_detach+0x164: movq %r15,0x30(%r12)
ddb> show proc
PROC (syz-executor) tid=468094 pid=7066 tcnt=1 stat=onproc
flags process=1044<INEXEC,PPWAIT,SINGLEEXIT> proc=0
runpri=73, usrpri=73, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0xffff80002a75dca0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a75d240,0xffffffff83a86100
process=0xffff8000380dc498 user=0xffff80003c8ec000, vmspace=0xfffffc00720bd2e8
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
* 7066 468094 78563 0 7 0x1044 0 syz-executor
3592 101675 46346 0 2 0 0 syz-executor
3592 447206 46346 0 3 0 0x4000080 bell syz-executor
43569 282596 33146 0 2 0 0 syz-executor
75599 418280 87249 0 2 0x10 0 syz-executor
75599 125221 87249 0 3 0x10 0x4000080 fsleep syz-executor
74671 504525 82501 0 2 0 0 syz-executor
74671 321237 82501 0 3 0 0x4000080 fsleep syz-executor
55234 209551 63725 0 2 0 0 syz-executor
55234 76843 63725 0 2 0 0x4000000 syz-executor
55234 124490 63725 0 3 0 0x4000000 inode syz-executor
55234 379288 63725 0 3 0 0x4000080 fsleep syz-executor
78563 147476 61201 0 3 0x82 0 ppwait syz-executor
63725 127527 61201 0 2 0x2 0xc80 syz-executor
33146 132716 61201 0 2 0x2 0xc80 syz-executor
33213 119034 61201 0 3 0x2 0x80 piperd syz-executor
87249 31408 61201 0 2 0x2 0xc80 syz-executor
82501 359801 61201 0 3 0x2 0x80 nanoslp syz-executor
51935 424348 61201 0 2 0x2 0 syz-executor
46346 35379 61201 0 3 0x2 0x80 nanoslp syz-executor
61201 434458 74600 0 2 0x2 0 syz-executor
74600 32923 54894 0 3 0x100002 0x88 sigsusp ksh
54894 88530 59108 0 3 0x10 0x88 kqread sshd-session
59108 74853 72287 0 3 0x12 0x80 kqread sshd-session
13862 301678 1 0 3 0x100003 0x80 ttyin getty
72287 446687 1 0 3 0 0x88 kqread sshd
90405 84864 78440 73 3 0x1100010 0x80 kqread syslogd
78440 217200 1 0 3 0x100002 0x80 sbwait syslogd
42307 374024 1 0 3 0x100000 0x80 kqread resolvd
75630 324113 21066 77 3 0x100012 0x80 kqread dhcpleased
23723 392523 21066 77 3 0x100012 0x80 kqread dhcpleased
21066 119170 1 0 3 0 0x80 kqread dhcpleased
65054 245217 0 0 3 0x14000 0x200 bored smr
9789 256315 0 0 2 0x14000 0x200 zerothread
96292 64277 0 0 3 0x14000 0x200 aiodoned aiodoned
63159 344853 0 0 3 0x14000 0x200 syncer update
22785 489238 0 0 3 0x14000 0x200 cleaner cleaner
34639 249621 0 0 3 0x14000 0x200 reaper reaper
47146 234062 0 0 3 0x14000 0x200 pgdaemon pagedaemon
60857 392411 0 0 3 0x14000 0x200 bored viomb
48888 326475 0 0 3 0x14000 0x40000200 acpi0 acpi0
86539 119426 0 0 3 0x14000 0x200 bored softnet0
62858 356151 0 0 3 0x14000 0x200 bored systqmp
46857 17382 0 0 3 0x14000 0x200 bored systq
34143 462141 0 0 3 0x14000 0x40000200 tmoslp softclock
29893 126331 0 0 3 0x14000 0x40000200 idle0
1 519323 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11041 12242K 12315K 166960K 12248 0
pcb 18 12K 12K 166960K 44 0
rtable 237 7K 8K 166960K 615 0
pf 31 13K 14K 166960K 64 0
ifaddr 41 7K 7K 166960K 84 0
ifgroup 50 2K 2K 166960K 95 0
sysctl 1 1K 9K 166960K 5 0
counters 33 17K 17K 166960K 46 0
ioctlops 0 0K 4K 166960K 58 0
iov 0 0K 12K 166960K 6 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1359 85K 86K 166960K 1646 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 5K 166960K 4 0
VM map 2 1K 1K 166960K 2 0
sem 6 0K 0K 166960K 7 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 16 57K 85K 166960K 351 0
sigio 0 0K 0K 166960K 2 0
proc 59 59K 91K 166960K 729 0
subproc 72 4K 4K 166960K 144 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 25 0
in_multi 93 6K 6K 166960K 188 0
ether_multi 1 0K 0K 166960K 1 0
mrt 0 0K 0K 166960K 10 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 61 281K 281K 166960K 61 0
exec 1 0K 1K 166960K 469 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 192 158K 167K 166960K 4450 0
UVM aobj 8 2K 2K 166960K 9 0
pinsyscall 38 76K 90K 166960K 1647 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 6 0
NDP 13 0K 2K 166960K 54 0
temp 34 9106K 9126K 166960K 4906 0
kqueue 13 20K 26K 166960K 43 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 57 0 54 1 0 1 1 0 8 0
rtentry 136 205 0 98 4 0 4 4 0 8 0
unpcb 144 83 0 64 1 0 1 1 0 8 0
syncache 336 5 0 5 1 0 1 1 0 8 1
tcpcb 736 38 0 33 1 0 1 1 0 8 0
arp 96 36 0 19 1 0 1 1 0 8 0
ipq 40 3 0 0 1 0 1 1 0 8 0
ipqe 40 134 0 131 1 0 1 1 0 8 0
inpcb 328 175 0 163 2 0 2 2 0 8 0
ip6q 80 1 0 1 1 0 1 1 0 8 1
ip6af 40 2 0 2 1 0 1 1 0 8 1
nd6 112 49 0 25 1 0 1 1 0 8 0
pkpcb 40 1 0 1 1 0 1 1 0 8 1
kcovpl 48 16 0 8 1 0 1 1 0 8 0
ppxss 1072 4 0 4 1 0 1 1 0 8 1
pfstscr 40 2 0 2 1 0 1 1 0 8 1
pfstkey 128 2 0 2 1 0 1 1 0 8 1
pfstate 384 1 0 1 1 0 1 1 0 8 1
pfrule 1360 1 0 1 1 0 1 1 0 8 1
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 818 0 373 32 0 32 32 0 8 2
art_table 40 819 0 373 6 0 6 6 0 8 0
art_node 32 205 0 109 1 0 1 1 0 8 0
semapl 72 4 0 0 1 0 1 1 0 8 0
shmpl 112 6 0 1 1 0 1 1 0 8 0
dirhash 1024 21 0 4 3 0 3 3 0 8 0
dino2pl 256 1771 0 291 93 0 93 93 0 8 0
ffsino 256 1771 0 291 93 0 93 93 0 8 0
nchpl 144 2097 0 371 65 0 65 65 0 8 1
vnodes 216 2099 0 0 117 0 117 117 0 8 0
namei 1024 8179 0 8175 4 0 4 4 0 8 3
kstatmem 264 49 0 26 2 0 2 2 0 8 0
scxspl 216 9539 0 9539 4 0 4 4 1 8 4
plimitpl 152 254 0 237 1 0 1 1 0 8 0
sigapl 424 630 0 589 6 0 6 6 0 8 1
knotepl 120 5686 0 5639 9 0 9 9 0 8 7
kqueuepl 184 42 0 33 1 0 1 1 0 8 0
pipepl 304 153 0 126 3 0 3 3 0 8 0
fdescpl 448 617 0 589 4 0 4 4 0 8 0
filepl 120 2467 0 2187 10 0 10 10 0 8 1
lockfpl 104 46 0 43 1 0 1 1 0 8 0
lockfspl 48 23 0 20 1 0 1 1 0 8 0
sessionpl 144 40 0 32 1 0 1 1 0 8 0
pgrppl 48 58 0 42 1 0 1 1 0 8 0
ucredpl 104 250 0 238 1 0 1 1 0 8 0
zombiepl 144 589 0 589 1 0 1 1 0 8 1
processpl 1152 630 0 589 4 0 4 4 0 8 0
procpl 664 792 0 745 6 0 6 6 0 8 1
sockpl 552 319 0 285 3 0 3 3 0 8 0
mcl64k 65536 5 0 5 1 0 1 1 0 8 1
mcl8k 8192 5 0 5 1 0 1 1 0 8 1
mcl4k 4096 2648 0 2596 14 0 14 14 0 8 7
mcl2k 2048 371 0 369 4 0 4 4 0 8 3
mextrefs 64 128 0 128 1 0 1 1 0 8 1
mtagpl 96 5 0 5 1 0 1 1 0 8 1
mbufpl 256 6230 0 6069 19 0 19 19 0 8 5
bufpl 272 3800 0 115 246 0 246 246 0 8 0
anonpl 24 110049 0 106950 41 0 41 41 0 187 15
amapchunkpl 152 12386 0 12001 22 0 22 22 0 158 5
amappl16 200 1928 0 1895 13 0 13 13 0 8 11
amappl15 192 7 0 7 1 0 1 1 0 8 1
amappl14 184 501 0 500 1 0 1 1 0 8 0
amappl13 176 128 0 118 1 0 1 1 0 8 0
amappl12 168 910 0 885 2 0 2 2 0 8 0
amappl11 160 6 0 6 1 0 1 1 0 8 1
amappl10 152 55 0 45 1 0 1 1 0 8 0
amappl9 144 289 0 289 1 0 1 1 0 8 1
amappl8 136 147 0 146 1 0 1 1 0 8 0
amappl7 128 151 0 140 1 0 1 1 0 8 0
amappl6 120 226 0 225 1 0 1 1 0 8 0
amappl5 112 95 0 87 1 0 1 1 0 8 0
amappl4 104 297 0 281 1 0 1 1 0 8 0
amappl3 96 2235 0 2162 3 0 3 3 0 8 0
amappl2 88 706 0 637 2 0 2 2 0 8 0
amappl1 80 11437 0 10900 13 0 13 13 0 8 1
amappl 88 3616 0 3487 4 0 4 4 0 92 0
uvmvnodes 80 101 0 0 3 0 3 3 0 8 0
dma8192 8192 1 0 1 1 0 1 1 0 8 1
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 253 0 253 1 0 1 1 0 8 1
dma64 64 6 0 6 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 8 0 1 1 0 1 1 0 8 0
uaddrrnd 24 617 0 589 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 617 0 589 1 0 1 1 0 8 0
vmmpekpl 168 6725 0 6675 3 0 3 3 0 8 0
vmmpepl 168 48759 0 47094 83 0 83 83 0 357 5
vmsppl 368 616 0 589 4 0 4 4 0 8 1
rwobjpl 40 16872 0 15949 12 0 12 12 0 8 1
pdppl 4096 1240 0 1178 96 28 68 76 0 8 6
pvpl 32 283581 0 275702 103 0 103 103 0 265 23
pmappl 216 616 0 589 2 0 2 2 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 622 0 28 17 0 17 17 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
udv_detach(ffff8000015e45c0) at udv_detach+0x164 sys/uvm/uvm_device.c:275
uvm_unmap_detach(ffff80003c8f0c88,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1370
uvmspace_exec(ffff80002a75dca0,1000,7f7fffffc000) at uvmspace_exec+0x451 sys/uvm/uvm_map.c:3404
sys_execve(ffff80002a75dca0,ffff80003c8f1330,ffff80003c8f1280) at sys_execve+0xfe8 sys/kern/kern_exec.c:517
syscall(ffff80003c8f1330) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c8f1330) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ec6bb1c30, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
udv_detach(ffff8000015e45c0) at udv_detach+0x164 sys/uvm/uvm_device.c:275
uvm_unmap_detach(ffff80003c8f0c88,0) at uvm_unmap_detach+0x15e sys/uvm/uvm_map.c:1370
uvmspace_exec(ffff80002a75dca0,1000,7f7fffffc000) at uvmspace_exec+0x451 sys/uvm/uvm_map.c:3404
sys_execve(ffff80002a75dca0,ffff80003c8f1330,ffff80003c8f1280) at sys_execve+0xfe8 sys/kern/kern_exec.c:517
syscall(ffff80003c8f1330) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c8f1330) at syscall+0x962 sys/arch/amd64/amd64/trap.c:791
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ec6bb1c30, count: -6
Struck through repros no longer work on HEAD.