syzbot


uvm_fault: pool_gc_pages (3)

Status: upstream: reported on 2026/01/31 13:26
Reported-by: syzbot+fc140c71faad46b3b3b7@syzkaller.appspotmail.com
First crash: 8d06h, last: 8d06h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pool_gc_pages (2) -1 9 535d 724d 0/3 auto-obsoleted due to no activity on 2024/11/20 01:16
openbsd uvm_fault: pool_gc_pages -1 4 1207d 1395d 0/3 auto-obsoleted due to no activity on 2023/01/17 22:31

Sample crash report:
uvm_fault(0xffffffff83a1c0d0, 0x0, 0, 2) -> e
kernel: page fault trap, code=2
Stopped at      pool_gc_pages+0x2bf:    movq    %rax,0(%rcx)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*309001  85968      0     0x14000      0x200    0  systqmp
pool_gc_pages(0) at pool_gc_pages+0x2bf pool_p_remove sys/kern/subr_pool.c:1055 [inline]
pool_gc_pages(0) at pool_gc_pages+0x2bf sys/kern/subr_pool.c:1584
taskq_thread(ffffffff8383f870) at taskq_thread+0x157 sys/kern/kern_task.c:446
end trace frame: 0x0, count: 13
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffffff83a1c0d0, 0x0, 0, 2) -> e
ddb{0}> trace
pool_gc_pages(0) at pool_gc_pages+0x2bf pool_p_remove sys/kern/subr_pool.c:1055 [inline]
pool_gc_pages(0) at pool_gc_pages+0x2bf sys/kern/subr_pool.c:1584
taskq_thread(ffffffff8383f870) at taskq_thread+0x157 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -2
ddb{0}> show registers
rdi                                0
rsi               0xffffffff8393a1c0    inpcb_pool+0x68
rbp               0xffff80002a20a090
rbx               0xfffffd806c728f90
rdx               0xffffffff8393a1c0    inpcb_pool+0x68
rcx                                0
rax                                0
r8                0xffffffffffffffff
r9                                 0
r10               0x8ef37d0e1b3bac00
r11                0x6d73c49e90f393e
r12                      0x1dcd65000
r13               0xffffffff8393a160    inpcb_pool+0x8
r14                            0xf90
r15               0xffffffff8393a158    inpcb_pool
rip               0xffffffff823101bf    pool_gc_pages+0x2bf
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a20a050
ss                              0x10
pool_gc_pages+0x2bf:    movq    %rax,0(%rcx)
ddb{0}> show proc
PROC (systqmp) tid=309001 pid=85968 tcnt=1 stat=onproc
    flags process=14000<NOZOMBIE,SYSTEM> proc=200<SYSTEM>
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffffe298,0xffff8000ffffea70
    process=0xffff8000ffff9810 user=0xffff80002a205000, vmspace=0xffffffff83a1c0d0
    estcpu=0, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  8071  233398  46342      0  2           0                syz-executor
  8071  306592  46342      0  2   0x4000000                syz-executor
 50300  386002  82191      0  2           0                syz-executor
 50300  299128  82191      0  3   0x4000080  fsleep        syz-executor
 22507  245503  73945      0  2       0xc80                syz-executor
 22507  471741  73945      0  3   0x4000080  netacc        syz-executor
 22507  163384  73945      0  3   0x4000080  fsleep        syz-executor
 17492   98278  25247      0  2       0xc80                syz-executor
 17492  240963  25247      0  3   0x4000080  lockf         syz-executor
 17492  388608  25247      0  3   0x4000080  fsleep        syz-executor
 44525  321869      1      0  3    0x100083  ttyin         getty
 35546  116114  10637      0  3        0x82  wait          syz-executor
 27004  489234      0      0  3     0x14280  nfsidl        nfsio
 88156   39648      0      0  3     0x14280  nfsidl        nfsio
 77612  230202      0      0  3     0x14280  nfsidl        nfsio
 29814  198271      0      0  3     0x14280  nfsidl        nfsio
 22678  413950      0      0  3     0x14280  nfsidl        nfsio
  8096  423984      0      0  3     0x14280  nfsidl        nfsio
 74643  505036      0      0  3     0x14280  nfsidl        nfsio
 50677   57282      0      0  3     0x14280  nfsidl        nfsio
 59125  407559      0      0  3     0x14280  nfsidl        nfsio
 72908  360506      0      0  3     0x14280  nfsidl        nfsio
 43767  332087      0      0  3     0x14280  nfsidl        nfsio
 42570  334975      0      0  3     0x14280  nfsidl        nfsio
 28797  111968      0      0  3     0x14280  nfsidl        nfsio
 33872   65252      0      0  3     0x14280  nfsidl        nfsio
  5504   17834      0      0  3     0x14280  nfsidl        nfsio
 83666  382708      0      0  3     0x14280  nfsidl        nfsio
 42941   95656      0      0  3     0x14280  nfsidl        nfsio
 80443  325192      0      0  3     0x14280  nfsidl        nfsio
 40032  451986      0      0  3     0x14280  nfsidl        nfsio
 46958  165272      0      0  3     0x14280  nfsidl        nfsio
 74906  224579  10637      0  2       0xc82                syz-executor
 15798  295690  10637      0  2         0x2                syz-executor
 73945  476673  10637      0  2       0xc82                syz-executor
 46342   10236  10637      0  2       0xc82                syz-executor
 82191  370390  10637      0  2       0xc82                syz-executor
 25247  102518  10637      0  2       0xc82                syz-executor
 46748  266665  10637      0  3        0x82  piperd        syz-executor
 10637  425761   2894      0  2         0x2                syz-executor
  2894  433452  61755      0  3    0x10008a  sigsusp       ksh
 61755  503902  50334      0  3        0x98  kqread        sshd-session
 50334   19397  54932      0  3        0x92  kqread        sshd-session
 54932  154560      1      0  3        0x88  kqread        sshd
 87137  428322  20295     74  2   0x1100012                pflogd
 20295   16326      1      0  3        0x80  sbwait        pflogd
 24365  193937  20722     73  3   0x1100090  kqread        syslogd
 20722  377142      1      0  3    0x100082  sbwait        syslogd
 78332  494209      1      0  3    0x100080  kqread        resolvd
 41404  323727  92596     77  3    0x100092  kqread        dhcpleased
 67055  106749  92596     77  3    0x100092  kqread        dhcpleased
 92596  487043      1      0  3        0x80  kqread        dhcpleased
  5169  272177      0      0  3     0x14200  bored         smr
 94931  139611      0      0  2     0x14200                zerothread
 98218  462500      0      0  3     0x14200  aiodoned      aiodoned
 87878  135215      0      0  3     0x14200  syncer        update
 92659  113015      0      0  3     0x14200  cleaner       cleaner
 46699  290049      0      0  3     0x14200  reaper        reaper
 20210  523264      0      0  3     0x14200  pgdaemon      pagedaemon
 36701  462078      0      0  3     0x14200  bored         viomb
 61493  393433      0      0  3  0x40014200  acpi0         acpi0
 64435  210967      0      0  7  0x40014200                idle1
 78015  106729      0      0  3     0x14200  bored         softnet1
 33047  297431      0      0  3     0x14200  bored         softnet0
*85968  309001      0      0  7     0x14200                systqmp
 25984  367270      0      0  3     0x14200  bored         systq
 36885  328670      0      0  2     0x14200                softclockmp
 64340   93428      0      0  2  0x40014200                softclock
 71009   33304      0      0  3  0x40014200                idle0
     1  109622      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
CPU 0:
exclusive mutex inpcb r = 0 (0xffffffff8393a170)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1aa sys/kern/kern_lock.c:-1
#2  pool_gc_pages+0xf4 pl_enter_try sys/kern/subr_pool.c:109 [inline]
#2  pool_gc_pages+0xf4 sys/kern/subr_pool.c:1576
#3  taskq_thread+0x157 sys/kern/kern_task.c:446
#4  proc_trampoline+0x10
Process 85968 (systqmp) thread 0xffff8000ffffe530 (309001)
shared rwlock pools r = 0 (0xffffffff8383e7b8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_read+0x3e8 sys/kern/kern_rwlock.c:413
#2  pool_gc_pages+0x2e sys/kern/subr_pool.c:1568
#3  taskq_thread+0x157 sys/kern/kern_task.c:446
#4  proc_trampoline+0x10
shared rwlock systqmp r = 0 (0xffffffff8383f8e8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
exclusive mutex inpcb r = 0 (0xffffffff8393a170)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  mtx_enter_try+0x1aa sys/kern/kern_lock.c:-1
#2  pool_gc_pages+0xf4 pl_enter_try sys/kern/subr_pool.c:109 [inline]
#2  pool_gc_pages+0xf4 sys/kern/subr_pool.c:1576
#3  taskq_thread+0x157 sys/kern/kern_task.c:446
#4  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11066  12085K   12343K 166960K     13338        0
            pcb    20     16K      21K 166960K       637        0
         rtable   178     10K      12K 166960K       771        0
             pf    33     17K      81K 166960K       224        0
         ifaddr    32      5K       8K 166960K       165        0
        ifgroup    51      2K       2K 166960K       275        0
         sysctl     4      1K       9K 166960K        14        0
       counters    68     36K      38K 166960K       316        0
       ioctlops     0      0K       4K 166960K      2021        0
            iov     0      0K      24K 166960K       122        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1325     83K      85K 166960K      2369        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      2K       5K 166960K        10        0
         VM map     2      1K       1K 166960K         2        0
            sem    15      0K       0K 166960K        73        0
        dirhash    12      2K       2K 166960K        48        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K     236K 166960K      1843        0
          sigio     0      0K       0K 166960K        60        0
           proc    72    115K     164K 166960K       805        0
        subproc    72      4K       4K 166960K       108        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       201        0
       in_multi    56      4K       8K 166960K       234        0
    ether_multi     1      0K       0K 166960K        13        0
            mrt     0      0K       0K 166960K        14        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    91    413K     413K 166960K        91        0
           exec     0      0K       1K 166960K       984        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         2        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   239    172K     181K 166960K     18014        0
       UVM aobj    44     10K      10K 166960K        51        0
     pinsyscall    41     82K     108K 166960K      3160        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     1      0K       0K 166960K       115        0
            NDP    12      0K       1K 166960K       117        0
           temp    78   8688K    8763K 166960K     90784        0
         kqueue    15     24K      32K 166960K       341        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      242    0      239     2     1     1     2     0     8    0
rtentry    176      212    0      150     6     1     5     6     0     8    0
unpcb      144     1387    0     1369     9     5     4     6     0     8    3
syncache   336       13    0       13     3     2     1     1     0     8    1
tcpqe       32        6    0        6     2     1     1     1     0     8    1
tcpcb      736      435    0      422     2     0     2     2     0     8    0
arp        136       30    0       19     1     0     1     1     0     8    0
inpcb      328     1840    0     1821    14    10     4     9     0     8    2
inpcb: pool(0xffffffff8393a158:inpcb): page inconsistency: page 0x0; at page head addr 0xfffffd806c728f90 (p 0xfffffd806c728000)
nd6        152       52    0       36     2     0     2     2     0     8    0
pkpcb       40       16    0       16     2     2     0     1     0     8    0
kcovpl      48       12    0        4     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1192     100    0       99     1     0     1     1     0     8    0
pppxif     1504      13    0       13     3     3     0     1     0     8    0
pffrag     232       18    0        4     1     0     1     1     0   482    0
pffrnode    88       16    0        3     1     0     1     1     0     8    0
pffrent     40       26    0       12     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pfstitem    24        2    0        0     1     0     1     1     0     8    0
pfstkey    128        2    0        0     1     0     1     1     0     8    0
pfstate    448        1    0        0     1     0     1     1     0     8    0
rttmr      136        3    0        3     2     2     0     1     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256      986    0      710    30     6    24    30     0     8    4
art_table   40      988    0      710     5     0     5     5     0     8    0
art_node    32      211    0      155     1     0     1     1     0     8    0
sysvmsgpl   40       72    0       69     1     0     1     1     0     8    0
semapl     112       66    0       53     1     0     1     1     0     8    0
shmpl      112       42    0        4     2     0     2     2     0     8    0
dirhash    1024      41    0       24     3     0     3     3     0     8    0
dino2pl    256     4741    0     3235    96     0    96    96     0     8    0
ffsino     296     4741    0     3235   117     0   117   117     0     8    0
nchpl      144     7162    0     5444    64     0    64    64     0     8    0
rtmask      32       15    0       15     4     3     1     1     0     8    1
vnodes     216     5168    0        0   288     0   288   288     0     8    0
namei      1024   24433    0    24433     2     1     1     2     0     8    1
percpumem   16      173    0      124     1     0     1     1     0     8    0
vcpupl     3968       4    0        1     1     0     1     1     0     8    0
vmpool     848        6    0        3     1     0     1     1     0     8    0
kstatmem   264      186    0      160     3     0     3     3     0     8    1
scsiplug    72        7    0        7     3     2     1     1     0     8    1
scxspl     216    47614    0    47613    12    10     2     8     1     8    1
plimitpl   152      604    0      587     1     0     1     1     0     8    0
sigapl     424     2199    0     2133    10     2     8     8     0     8    0
knotepl    120      563    0        0    17     0    17    17     0     8    0
kqueuepl   224      740    0      728     9     7     2     9     0     8    1
pipepl     344      297    0      270     6     3     3     6     0     8    0
fdescpl    528     2139    0     2109     3     0     3     3     0     8    0
filepl     160    12685    0    12460    19     6    13    16     0     8    0
lockfpl    104      542    0      538     1     0     1     1     0     8    0
lockfspl    48      188    0      185     1     0     1     1     0     8    0
sessionpl  144       39    0       30     1     0     1     1     0     8    0
pgrppl      48       73    0       56     1     0     1     1     0     8    0
ucredpl    104     1947    0     1933     1     0     1     1     0     8    0
zombiepl   144     2135    0     2133     1     0     1     1     0     8    0
processpl  1232    2199    0     2133     6     0     6     6     0     8    0
procpl     664     4923    0     4851     9     1     8     8     0     8    0
sosppl     176        4    0        4     2     2     0     1     0     8    0
sockpl     752     3541    0     3500    26    14    12    17     0     8    6
mcl64k     65536      6    0        0     1     0     1     1     0     8    0
mcl16k     16384      4    0        0     1     0     1     1     0     8    0
mcl12k     12288      2    0        0     1     0     1     1     0     8    0
mcl9k      9216       2    0        0     1     0     1     1     0     8    0
mcl8k      8192      10    0        0     2     0     2     2     0     8    0
mcl4k      4096     118    0        0    15     0    15    15     0     8    0
mcl2k2     2112       3    0        0     1     0     1     1     0     8    0
mcl2k      2048      33    0        0     4     0     4     4     0     8    0
mtagpl      96        2    0        0     1     0     1     1     0     8    0
mbufpl     256     1254    0        0    79     0    79    79     0     8    0
bufpl      280    18901    0    12765   439     0   439   439     0     8    0
anonpl      32    17903    0        0   145     0   145   145     0   246    0
amapchunkpl 152   61152    0    60681    37     5    32    32     0   158    9
amappl16   200     7835    0     7802    72    58    14    47     0     8    8
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184       11    0       11     1     1     0     1     0     8    0
amappl13   176      484    0      483     1     0     1     1     0     8    0
amappl12   168     2599    0     2558     3     0     3     3     0     8    0
amappl11   160        8    0        8     2     2     0     1     0     8    0
amappl10   152       58    0       43     1     0     1     1     0     8    0
amappl9    144      247    0      247     1     1     0     1     0     8    0
amappl8    136       30    0       27     1     0     1     1     0     8    0
amappl7    128      113    0      111     1     0     1     1     0     8    0
amappl6    120      348    0      334     1     0     1     1     0     8    0
amappl5    112       86    0       76     1     0     1     1     0     8    0
amappl4    104      513    0      484     1     0     1     1     0     8    0
amappl3     96    10952    0    10861     4     1     3     3     0     8    0
amappl2     88     2342    0     2263     2     0     2     2     0     8    0
amappl1     80    19458    0    18876    15     1    14    15     0     8    0
amappl      88    16892    0    16733     6     1     5     5     0    92    0
uvmvnodes   80      157    0        0     4     0     4     4     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma2048    2048       2    0        2     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      254    0      254     2     2     0     1     0     8    0
dma64       64        7    0        7     2     2     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       50    0        7     1     0     1     1     0     8    0
uaddrrnd    24     2139    0     2109     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2139    0     2109     1     0     1     1     0     8    0
vmmpekpl   168    17892    0    17833     4     0     4     4     0     8    0
vmmpepl    168   143689    0   141817   124    26    98   124     0   357    5
vmsppl     488     2138    0     2109     6     1     5     5     0     8    0
rwobjpl     80    39921    0    38794    43    13    30    41     0     8    0
pdppl      4096    4297    0     4227   109    35    74    85     0     8    4
pvpl        32    24141    0        0   196     1   195   195     0   265    0
pmappl     256     2144    0     2112     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      358    0       48    10     0    10    10     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
pool_gc_pages(0) at pool_gc_pages+0x2bf pool_p_remove sys/kern/subr_pool.c:1055 [inline]
pool_gc_pages(0) at pool_gc_pages+0x2bf sys/kern/subr_pool.c:1584
taskq_thread(ffffffff8383f870) at taskq_thread+0x157 sys/kern/kern_task.c:446
end trace frame: 0x0, count: -2
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff8000299ddff0) at sched_idle+0x391 sys/kern/kern_sched.c:191
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff8000299ddff0) at sched_idle+0x391 sys/kern/kern_sched.c:191
end trace frame: 0x0, count: -5

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/31 13:26 openbsd 3729e22e7105 afc0c4d4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: pool_gc_pages
* Struck through repros no longer work on HEAD.