syzbot


uvm_fault: pf_anchor_global_RB_INSERT_COLOR (2)

Status: fixed on 2022/06/27 02:23
Reported-by: syzbot+df65f8b7ee8c0089e885@syzkaller.appspotmail.com
Fix commit: 30d709c8a85c Allow waiting during ktable allocation in pf_ioctl.
First crash: 155d, last: 155d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: pf_anchor_global_RB_INSERT_COLOR 1 251d 251d 0/3 auto-closed as invalid on 2022/06/20 02:23

Sample crash report:
uvm_fault(0xfffffd806c5fd670, 0x11e57ee8, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      pf_anchor_global_RB_INSERT_COLOR+0x70:  movl    0x18(%r14),%r12d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*206877  96058      0           0  0x4000000    0  syz-executor.4
pf_anchor_global_RB_INSERT_COLOR(ffffffff82ac33a0,ffff800000c8b000) at pf_anchor_global_RB_INSERT_COLOR+0x70 sys/net/pf_ruleset.c:84
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de pf_anchor_global_RB_INSERT sys/net/pf_ruleset.c:84 [inline]
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de sys/net/pf_ruleset.c:203
pf_find_or_create_ruleset(ffff800000c63804) at pf_find_or_create_ruleset+0x372 sys/net/pf_ruleset.c:269
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 pf_begin_rules sys/net/pf_ioctl.c:529 [inline]
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 sys/net/pf_ioctl.c:2514
VOP_IOCTL(fffffd806e828858,c0104451,ffff8000216cb9e0,3,fffffd807f7d77e0,ffff800024b07270) at VOP_IOCTL+0x8d sys/kern/vfs_vops.c:264
vn_ioctl(fffffd80692f4180,c0104451,ffff8000216cb9e0,ffff800024b07270) at vn_ioctl+0xb7 sys/kern/vfs_vnops.c:528
sys_ioctl(ffff800024b07270,ffff8000216cbaf8,ffff8000216cbb50) at sys_ioctl+0x49e
syscall(ffff8000216cbbc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x100062e68ee0, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd806c5fd670, 0x11e57ee8, 0, 1) -> e
ddb> trace
pf_anchor_global_RB_INSERT_COLOR(ffffffff82ac33a0,ffff800000c8b000) at pf_anchor_global_RB_INSERT_COLOR+0x70 sys/net/pf_ruleset.c:84
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de pf_anchor_global_RB_INSERT sys/net/pf_ruleset.c:84 [inline]
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de sys/net/pf_ruleset.c:203
pf_find_or_create_ruleset(ffff800000c63804) at pf_find_or_create_ruleset+0x372 sys/net/pf_ruleset.c:269
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 pf_begin_rules sys/net/pf_ioctl.c:529 [inline]
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 sys/net/pf_ioctl.c:2514
VOP_IOCTL(fffffd806e828858,c0104451,ffff8000216cb9e0,3,fffffd807f7d77e0,ffff800024b07270) at VOP_IOCTL+0x8d sys/kern/vfs_vops.c:264
vn_ioctl(fffffd80692f4180,c0104451,ffff8000216cb9e0,ffff800024b07270) at vn_ioctl+0xb7 sys/kern/vfs_vnops.c:528
sys_ioctl(ffff800024b07270,ffff8000216cbaf8,ffff8000216cbb50) at sys_ioctl+0x49e
syscall(ffff8000216cbbc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x100062e68ee0, count: -9
ddb> show registers
rdi                              0x1
rsi                              0x1
rbp               0xffff8000216cb5d0
rbx               0xffff800000c8b000
rdx                                0
rcx                                0
rax               0xffff800024b07270
r8                 0x101010101010101
r9                0x8080808080808080
r10               0x1ef37917a83f807e
r11               0xe20e2dcada64d6c3
r12                              0x1
r13               0xffff800000c32000
r14                       0x11e57ed0    __kernel_phys_end+0xf257ed0
r15               0xffff800000c66000
rip               0xffffffff824d4d70    pf_anchor_global_RB_INSERT_COLOR+0x70
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff8000216cb580
ss                              0x10
pf_anchor_global_RB_INSERT_COLOR+0x70:  movl    0x18(%r14),%r12d
ddb> show proc
PROC (syz-executor.4) pid=206877 stat=onproc
    flags process=0 proc=4000000<THREAD>
    pri=32, usrpri=81, nice=20
    forw=0xffffffffffffffff, list=0xffff800024b07510,0xffff800021684d38
    process=0xffff80002169db90 user=0xffff8000216c6000, vmspace=0xfffffd806c5fd670
    estcpu=36, cpticks=0, pctcpu=0.0
    user=0, sys=0, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 73427  424666  89558      0  2           0                syz-executor.5
 73427  327507  89558      0  3   0x4000080  fsleep        syz-executor.5
 52635   95557  83075      0  2           0                syz-executor.3
 52635  414737  83075      0  3   0x4000080  fsleep        syz-executor.3
 14438  391502  32381      0  2           0                syz-executor.0
 14438  189331  32381      0  3   0x4000080  fsleep        syz-executor.0
 96058  398547  41158      0  2           0                syz-executor.4
*96058  206877  41158      0  7   0x4000000                syz-executor.4
 96058  372254  41158      0  3   0x4000080  fsleep        syz-executor.4
  4614  213436  92440      0  2           0                syz-executor.6
  4614  492348  92440      0  2   0x4000000                syz-executor.6
  4614  361376  92440      0  3   0x4000080  fsleep        syz-executor.6
 34491   72889  29202      0  2           0                syz-executor.7
 34491  182982  29202      0  3   0x4000080  fsleep        syz-executor.7
 49919  202074  94041      0  2           0                syz-executor.2
 49919  437301  94041      0  3   0x4000080  fsleep        syz-executor.2
 29202   21140  38083      0  3        0x82  nanoslp       syz-executor.7
 41158  436275  38083      0  3        0x82  nanoslp       syz-executor.4
 32381  244595  38083      0  3        0x82  nanoslp       syz-executor.0
 30739  351197      0      0  3     0x14200  acct          acct
 58378   61813      0      0  3     0x14280  nfsidl        nfsio
 70965  469363      0      0  3     0x14280  nfsidl        nfsio
 15197  469818      0      0  3     0x14280  nfsidl        nfsio
 49738  105661      0      0  3     0x14280  nfsidl        nfsio
 88727   67550      0      0  3     0x14280  nfsidl        nfsio
 25132  304829      0      0  3     0x14280  nfsidl        nfsio
 37382  361135      0      0  3     0x14280  nfsidl        nfsio
 52553  354222      0      0  3     0x14280  nfsidl        nfsio
 43431  107200      0      0  3     0x14280  nfsidl        nfsio
 95006  147788      0      0  3     0x14280  nfsidl        nfsio
 58790  276541      0      0  3     0x14280  nfsidl        nfsio
  2509   15243      0      0  3     0x14280  nfsidl        nfsio
 77401  411811      0      0  3     0x14280  nfsidl        nfsio
 63267  413547      0      0  3     0x14280  nfsidl        nfsio
  9007  356470      0      0  3     0x14280  nfsidl        nfsio
  2045  368354      0      0  3     0x14280  nfsidl        nfsio
 86238  140037      0      0  3     0x14280  nfsidl        nfsio
 41981   99352      0      0  3     0x14280  nfsidl        nfsio
 21312  425333      0      0  3     0x14280  nfsidl        nfsio
 21163  502910      0      0  3     0x14280  nfsidl        nfsio
 97659  218944  38083      0  3        0x82  nanoslp       syz-executor.1
 92440   91325  38083      0  3        0x82  nanoslp       syz-executor.6
 83075  113064  38083      0  3        0x82  nanoslp       syz-executor.3
 94041  383545  38083      0  3        0x82  nanoslp       syz-executor.2
 63212  450358      0      0  3     0x14200  bored         sosplice
 89558  490128  38083      0  3        0x82  nanoslp       syz-executor.5
 38083  340958  89889      0  3        0x82  thrsleep      syz-fuzzer
 38083  412243  89889      0  3   0x4000082  thrsleep      syz-fuzzer
 38083   87230  89889      0  3   0x4000082  thrsleep      syz-fuzzer
 38083  395985  89889      0  3   0x4000082  thrsleep      syz-fuzzer
 38083  487417  89889      0  3   0x4000082  thrsleep      syz-fuzzer
 38083  336732  89889      0  3   0x4000082  kqread        syz-fuzzer
 38083  299955  89889      0  3   0x4000082  thrsleep      syz-fuzzer
 38083  515632  89889      0  3   0x4000082  thrsleep      syz-fuzzer
 38083  244877  89889      0  3   0x4000082  thrsleep      syz-fuzzer
 89889  455723  78902      0  3    0x10008a  sigsusp       ksh
 78902   10967   6194      0  3        0x9a  kqread        sshd
 70648  208887      1      0  3    0x100083  ttyin         getty
  6194  518107      1      0  3        0x88  kqread        sshd
 12245  427053  66537     73  3   0x1100090  kqread        syslogd
 66537  471113      1      0  3    0x100082  netio         syslogd
 26663  402375      1      0  3    0x100080  kqread        resolvd
 68737  429915  10110     77  3    0x100092  kqread        dhcpleased
 14490  265756  10110     77  3    0x100092  kqread        dhcpleased
 10110  372954      1      0  3        0x80  kqread        dhcpleased
 46834  489836      0      0  3     0x14200  bored         smr
  3896  453813      0      0  2     0x14200                zerothread
 80533  331401      0      0  3     0x14200  aiodoned      aiodoned
 97174  445854      0      0  3     0x14200  syncer        update
  1719  113696      0      0  3     0x14200  cleaner       cleaner
  1302   49974      0      0  3     0x14200  reaper        reaper
  3093  114941      0      0  3     0x14200  pgdaemon      pagedaemon
 58912  292494      0      0  3     0x14200  bored         viomb
 73157  247373      0      0  3  0x40014200  acpi0         acpi0
 91553  508712      0      0  3     0x14200  bored         softnet
 49352  341223      0      0  3     0x14200  bored         softnet
 66413  211693      0      0  3     0x14200  bored         softnet
 28677  327108      0      0  3     0x14200  bored         softnet
  9662   58610      0      0  3     0x14200  bored         systqmp
 35138    5815      0      0  3     0x14200  bored         systq
 85815  283969      0      0  3  0x40014200  bored         softclock
 79172  225946      0      0  3  0x40014200                idle0
     1  371266      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10162   6420K    6933K  78643K     16042        0
            pcb    13     14K      16K  78643K       274        0
         rtable   134      7K      10K  78643K      1203        0
         ifaddr    71     16K      19K  78643K       994        0
         sysctl     2      0K       0K  78643K         2        0
       counters    24     17K      17K  78643K        67        0
       ioctlops     0      0K       4K  78643K      4618        0
            iov     0      0K      28K  78643K       270        0
          mount     1      1K       1K  78643K         1        0
            log     0      0K       0K  78643K         4        0
         vnodes  1413     88K      89K  78643K      2703        0
      UFS quota     1     32K      32K  78643K         1        0
      UFS mount     5     36K      36K  78643K         5        0
            shm     2      1K       5K  78643K        28        0
         VM map     2      0K       0K  78643K         2        0
            sem    10      1K       1K  78643K        13        0
        dirhash    12      2K       2K  78643K        12        0
           ACPI  1697    195K     286K  78643K     12548        0
      file desc    17     61K      81K  78643K      3588        0
          sigio     0      0K       0K  78643K        23        0
           proc    58     59K      83K  78643K       876        0
        subproc   104      6K       7K  78643K       247        0
    NFS srvsock     1      0K       0K  78643K         1        0
     NFS daemon     1     16K      16K  78643K         1        0
    ip_moptions     0      0K       0K  78643K        23        0
       in_multi    47      3K       6K  78643K       292        0
    ether_multi     1      0K       0K  78643K        21        0
            mrt     0      0K       0K  78643K        20        0
    ISOFS mount     1     32K      32K  78643K         1        0
  MSDOSFS mount     1     16K      16K  78643K         1        0
           ttys    61    281K     281K  78643K        61        0
           exec     0      0K       2K  78643K      1078        0
            tdb     3      0K       0K  78643K         3        0
        pagedep     1      8K       8K  78643K         1        0
       inodedep     1     32K      32K  78643K         1        0
         newblk     1      0K       0K  78643K         1        0
        VM swap     7     26K      26K  78643K         7        0
       UVM amap   266    180K     626K  78643K     20243        0
       UVM aobj   125      3K       3K  78643K       125        0
        memdesc     1      4K       4K  78643K         1        0
    crypto data     1      1K       1K  78643K         1        0
    ip6_options     0      0K       0K  78643K       187        0
            NDP     9      0K       2K  78643K        97        0
           temp   150   4792K    5806K  78643K     68754        0
         kqueue    14     22K      30K  78643K      1562        0
      SYN cache     2     16K      16K  78643K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      163    0      160     2     1     1     2     0     8    0
rtentry    112      284    0      232     4     1     3     4     0     8    0
unpcb      136     1438    0     1422    19    16     3     6     0     8    2
syncache   296        7    0        7     2     2     0     1     0     8    0
tcpqe       32        3    0        3     1     1     0     1     0     8    0
tcpcb      736      853    0      846    47    38     9    13     0     8    8
arp         88       40    0       34     1     0     1     1     0     8    0
inpcb      312     2088    0     2080    51    42     9    11     0     8    8
ip6q        72       34    0       34     1     1     0     1     0     8    0
ip6af       40       68    0       68     1     1     0     1     0     8    0
nd6         48       64    0       55     1     0     1     1     0     8    0
pkpcb       40       15    0       15     3     3     0     1     0     8    0
kcovpl      48       19    0       11     1     0     1     1     0     8    0
ppxss      1152       7    0        7     1     1     0     1     0     8    0
pfstscr     40       67    0       67     1     1     0     1     0     8    0
pfosfp      40        3    0        2     1     0     1     1     0     8    0
pfosfpen   112        3    0        2     1     0     1     1     0     8    0
pfrktable  1344     184    0      178     2     1     1     1     0     8    0
pftag       88       18    0       14     1     0     1     1     0     8    0
pfstkey    112       67    0       67     1     1     0     1     0     8    0
pfstate    336       67    0       67     1     1     0     1     0     8    0
pfrule     1360     415    0      386     3     0     3     3     0     8    0
rttmr       64        7    0        7     2     2     0     1     0     8    0
art_heap8  4096       1    0        0     1     0     1     1     0     8    0
art_heap4  256     1171    0      939    33    14    19    29     0     8    0
art_table   32     1172    0      939     4     0     4     4     0     8    1
art_node    16      283    0      237     1     0     1     1     0     8    0
sysvmsgpl   40        9    0        3     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112        8    0        0     1     0     1     1     0     8    0
shmpl      112      122    0        0     4     0     4     4     0     8    0
dirhash    1024      17    0        0     3     0     3     3     0     8    0
dino2pl    256     5573    0     4124    91     0    91    91     0     8    0
ffsino     240     5573    0     4124    86     0    86    86     0     8    0
nchpl      144    10259    0     8632    63     0    63    63     0     8    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
vnodes     224     5926    0        0   349     0   349   349     0     8    0
namei      1024   36783    0    36783     2     1     1     2     0     8    1
vcpupl     1984       7    0        1     1     0     1     1     0     8    0
vmpool     528        7    0        1     1     0     1     1     0     8    0
pfiaddrpl  120      394    0      388     2     1     1     1     0     8    0
kstatmem   264      104    0       86     2     0     2     2     0     8    0
scsiplug    72        3    0        3     1     1     0     1     0     8    0
scxspl     216    29522    0    29522    11    10     1     8     0     8    1
plimitpl   152      187    0      173     1     0     1     1     0     8    0
sigapl     424     3876    0     3809     8     0     8     8     0     8    0
futexpl     64    34131    0    34124     2     1     1     1     0     8    0
knotepl    120    68481    0    68399    27    22     5    11     0     8    2
kqueuepl   184     2104    0     2093    11    10     1     4     0     8    0
pipepl     304     4816    0     4784    39    29    10    10     0     8    7
fdescpl    432     3838    0     3810     4     0     4     4     0     8    0
filepl     120    30559    0    30246    56    40    16    16     0     8    6
lockfpl    104      714    0      711     2     1     1     2     0     8    0
lockfspl    48      206    0      203     1     0     1     1     0     8    0
sessionpl  144       34    0       18     1     0     1     1     0     8    0
pgrppl      48       72    0       56     1     0     1     1     0     8    0
ucredpl     96     2235    0     2223     1     0     1     1     0     8    0
zombiepl   144     3810    0     3809     1     0     1     1     0     8    0
processpl  1000    3876    0     3809    10     1     9     9     0     8    0
procpl     672     8946    0     8862    12     4     8     8     0     8    0
sosppl     168        6    0        6     1     1     0     1     0     8    0
sockpl     448     3704    0     3677   103    92    11    22     0     8    8
mcl64k     65536    140    0      140     8     7     1     1     0     8    1
mcl16k     16384     56    0       56    10     9     1     1     0     8    1
mcl12k     12288    118    0      118    10     9     1     1     0     8    1
mcl9k      9216      53    0       53    11    10     1     1     0     8    1
mcl8k      8192     152    0      152     6     5     1     1     0     8    1
mcl4k      4096     323    0      323     4     3     1     1     0     8    1
mcl2k2     2112      16    0       16     6     6     0     1     0     8    0
mcl2k      2048   75273    0    75224    19    11     8    10     0     8    1
mtagpl      96      526    0      349    10     2     8     8     0     8    1
mbufpl     256   142030    0   141642    59    22    37    37     0     8    0
bufpl      288     8999    0     2595   458     0   458   458     0     8    0
anonpl      24   697858    0   681342   181    78   103   125     0   188    0
amapchunkpl 152  286626    0   285988  2332  2207   125  2220     0   158   99
amappl16   200    10121    0     9569    65    35    30    42     0     8    0
amappl15   192     1081    0     1078     1     0     1     1     0     8    0
amappl14   184      692    0      684     1     0     1     1     0     8    0
amappl13   176      685    0      683     1     0     1     1     0     8    0
amappl12   168       14    0        9     1     0     1     1     0     8    0
amappl11   160      612    0      595     1     0     1     1     0     8    0
amappl10   152      137    0      130     1     0     1     1     0     8    0
amappl9    144      891    0      884     1     0     1     1     0     8    0
amappl8    136     1227    0     1161     3     0     3     3     0     8    0
amappl7    128      616    0      603     1     0     1     1     0     8    0
amappl6    120      647    0      627     2     1     1     2     0     8    0
amappl5    112     2784    0     2769     1     0     1     1     0     8    0
amappl4    104     2182    0     2152     2     1     1     2     0     8    0
amappl3     96    10360    0    10310     2     0     2     2     0     8    0
amappl2     88     4781    0     4716     3     1     2     3     0     8    0
amappl1     80    90694    0    90036    24     9    15    19     0     8    0
amappl      88    19528    0    19367     4     0     4     4     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      124    0        0     3     0     3     3     0     8    0
uaddrrnd    24     3845    0     3811     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     3845    0     3811     1     0     1     1     0     8    0
vmmpekpl   168    46267    0    46219     3     0     3     3     0     8    0
vmmpepl    168   368815    0   366222   200    82   118   150     0   357    1
vmsppl     272     3844    0     3811     4     1     3     3     0     8    0
rwobjpl     24    93558    0    85949    47     0    47    47     0     8    1
pdppl      4096    7696    0     7628   295   225    70    72     0     8    2
pvpl        32  1437806    0  1416720   323   143   180   238     0   265    6
pmappl     216     3844    0     3811     2     0     2     2     0     8    0
extentpl    40       58    0       38     1     0     1     1     0     8    0
phpool     112     1287    0      473    24     0    24    24     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
pf_anchor_global_RB_INSERT_COLOR(ffffffff82ac33a0,ffff800000c8b000) at pf_anchor_global_RB_INSERT_COLOR+0x70 sys/net/pf_ruleset.c:84
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de pf_anchor_global_RB_INSERT sys/net/pf_ruleset.c:84 [inline]
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de sys/net/pf_ruleset.c:203
pf_find_or_create_ruleset(ffff800000c63804) at pf_find_or_create_ruleset+0x372 sys/net/pf_ruleset.c:269
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 pf_begin_rules sys/net/pf_ioctl.c:529 [inline]
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 sys/net/pf_ioctl.c:2514
VOP_IOCTL(fffffd806e828858,c0104451,ffff8000216cb9e0,3,fffffd807f7d77e0,ffff800024b07270) at VOP_IOCTL+0x8d sys/kern/vfs_vops.c:264
vn_ioctl(fffffd80692f4180,c0104451,ffff8000216cb9e0,ffff800024b07270) at vn_ioctl+0xb7 sys/kern/vfs_vnops.c:528
sys_ioctl(ffff800024b07270,ffff8000216cbaf8,ffff8000216cbb50) at sys_ioctl+0x49e
syscall(ffff8000216cbbc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x100062e68ee0, count: -9
ddb> machine ddbcpu 1
No such command
ddb> trace
pf_anchor_global_RB_INSERT_COLOR(ffffffff82ac33a0,ffff800000c8b000) at pf_anchor_global_RB_INSERT_COLOR+0x70 sys/net/pf_ruleset.c:84
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de pf_anchor_global_RB_INSERT sys/net/pf_ruleset.c:84 [inline]
pf_create_anchor(0,ffff800000c6fc00) at pf_create_anchor+0x2de sys/net/pf_ruleset.c:203
pf_find_or_create_ruleset(ffff800000c63804) at pf_find_or_create_ruleset+0x372 sys/net/pf_ruleset.c:269
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 pf_begin_rules sys/net/pf_ioctl.c:529 [inline]
pfioctl(4900,c0104451,ffff8000216cb9e0,3,ffff800024b07270) at pfioctl+0x4a17 sys/net/pf_ioctl.c:2514
VOP_IOCTL(fffffd806e828858,c0104451,ffff8000216cb9e0,3,fffffd807f7d77e0,ffff800024b07270) at VOP_IOCTL+0x8d sys/kern/vfs_vops.c:264
vn_ioctl(fffffd80692f4180,c0104451,ffff8000216cb9e0,ffff800024b07270) at vn_ioctl+0xb7 sys/kern/vfs_vnops.c:528
sys_ioctl(ffff800024b07270,ffff8000216cbaf8,ffff8000216cbb50) at sys_ioctl+0x49e
syscall(ffff8000216cbbc0) at syscall+0x44e sys/arch/amd64/amd64/trap.c:585
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x100062e68ee0, count: -9

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2022/06/25 14:19 openbsd 88e033f9985d a371c43c .config log report uvm_fault: pf_anchor_global_RB_INSERT_COLOR
* Struck through repros no longer work on HEAD.