syzbot


protection_fault: icmp_mtudisc_timeout (4)

Status: upstream: reported on 2025/07/16 23:24
Reported-by: syzbot+5de334298738b60f07ab@syzkaller.appspotmail.com
First crash: 111d, last: 1d11h
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: icmp_mtudisc_timeout (2) -1 1 419d 419d 0/3 auto-obsoleted due to no activity on 2024/12/10 05:16
openbsd protection_fault: icmp_mtudisc_timeout -1 3 581d 634d 0/3 auto-obsoleted due to no activity on 2024/07/01 04:08
openbsd protection_fault: icmp_mtudisc_timeout (3) -1 1 257d 257d 0/3 auto-obsoleted due to no activity on 2025/05/21 20:37

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      icmp_mtudisc_timeout+291:       movq    0(%rax),%rcx
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
icmp_mtudisc_timeout(fffffd806b7d9220,0) at icmp_mtudisc_timeout+291
rt_timer_queue_flush(ffffffff839920f8) at rt_timer_queue_flush+653
ip_sysctl(ffff80002a362bec,1,0,ffff80002a362c18,200000001300,4) at ip_sysctl+2125
net_sysctl(ffff80002a362be4,3,0,ffff80002a362c18,200000001300,4,4fc739380812767b) at net_sysctl+1614
sys_sysctl(ffff80003c42c028,ffff80002a362d50,ffff80002a362ca0) at sys_sysctl+997
syscall(ffff80002a362d50) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xeefae5174f0, count: -7
ddb{0}> show registers
rdi                               20
rsi                               20
rbp             18446603336929389088
rbx             18446603336929389057
rdx             18446603336242663872
rcx             18446603337232203816
rax              7527431376043171465
r8              18446744071590299072    tcp_mtudisc_increase
r9                                 0
r10              7036638950363239886
r11             15110371126199137147
r12             18446603336221399128
r13                               20
r14                                0
r15             18446741326733873696
rip             18446744071610789011    icmp_mtudisc_timeout+291
cs                                 8
rflags                         66118    __ALIGN_SIZE+62022
rsp             18446603336929389008
ss                                16
icmp_mtudisc_timeout+291:       movq    0(%rax),%rcx
ddb{0}> show proc
PROC (syz-executor) tid=387870 pid=80546 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c42d250,0xffffffff8389d358
    process=0xffff8000fffeb510 user=0xffff80002a35d000, vmspace=0xfffffd806c00fd78
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 80546    2289  64223      0  2           0                syz-executor
*80546  387870  64223      0  7   0x4000000                syz-executor
 57887   93725  95997  60929  2        0x10                syz-executor
 57887  168501  95997  60929  2   0x4000010                syz-executor
 22175  477951  97373      0  3        0x80  nanoslp       syz-executor
 22175  449834  97373      0  3   0x4000080  netcon        syz-executor
 22175  295547  97373      0  3   0x4000080  fsleep        syz-executor
 74292  102834  79901      0  2           0                syz-executor
 74292    5094  79901      0  3   0x4000080  fsleep        syz-executor
 28915    8574   4593      0  2           0                syz-executor
 28915  482091   4593      0  3   0x4000080  fsleep        syz-executor
 28915   72289   4593      0  3   0x4000080  fsleep        syz-executor
 28915  313323   4593      0  3   0x4000080  fsleep        syz-executor
 28915  181084   4593      0  3   0x4000080  fsleep        syz-executor
 28915   61356   4593      0  3   0x4000080  fsleep        syz-executor
  6277  309965  27269      0  3      0x3000  suspend       syz-executor
  6277   90946  27269      0  2   0x4081000                syz-executor
 55902  377092      0      0  3     0x14200  acct          acct
 95997  522297  79562      0  3        0x82  nanoslp       syz-executor
 64223  250856  79562      0  3        0x82  nanoslp       syz-executor
 79901  173112  79562      0  3        0x82  nanoslp       syz-executor
 97373  454666  79562      0  3        0x82  nanoslp       syz-executor
  4593   84145  79562      0  3        0x82  nanoslp       syz-executor
 27269   49654  79562      0  3        0x82  nanoslp       syz-executor
 65075  116879      1      0  3    0x100083  ttyin         getty
 42494   28306  79562      0  3        0x82  nanoslp       syz-executor
 89647  111487  79562      0  3        0x82  wait          syz-executor
 79562  422729  86929      0  3        0x82  kqread        syz-executor
 86929  286048  14462      0  3    0x10008a  sigsusp       ksh
 14462  415216   6935      0  3        0x98  kqread        sshd-session
  6935  417778  81691      0  3        0x92  kqread        sshd-session
 81691  481642      1      0  3        0x88  kqread        sshd
 27882   82823  43278     74  3   0x1100092  bpf           pflogd
 43278   52940      1      0  3        0x80  sbwait        pflogd
 36291   16798  55156     73  3   0x1100090  kqread        syslogd
 55156  132856      1      0  3    0x100082  sbwait        syslogd
 17062  147021      1      0  3    0x100080  kqread        resolvd
 72491   10902  60491     77  3    0x100092  kqread        dhcpleased
 84899  178184  60491     77  3    0x100092  kqread        dhcpleased
 60491  175840      1      0  3        0x80  kqread        dhcpleased
 15043  109594      0      0  3     0x14200  bored         smr
 18176  166892      0      0  2     0x14200                zerothread
 50074  459978      0      0  3     0x14200  aiodoned      aiodoned
 45539  382016      0      0  3     0x14200  syncer        update
 14338  459339      0      0  3     0x14200  cleaner       cleaner
 10310  189753      0      0  3     0x14200  reaper        reaper
 86311  278974      0      0  3     0x14200  pgdaemon      pagedaemon
 66034  130603      0      0  3     0x14200  bored         viomb
 85684  243388      0      0  3  0x40014200  acpi0         acpi0
 77878   51778      0      0  7  0x40014200                idle1
 46983  480844      0      0  3     0x14200  bored         softnet1
  2876  286737      0      0  3     0x14200  bored         softnet0
 10967  145658      0      0  2     0x14200                systqmp
 43184  115571      0      0  3     0x14200  bored         systq
 95006  328052      0      0  3     0x14200  tmoslp        softclockmp
 59909  462452      0      0  3  0x40014200  tmoslp        softclock
 57578  464039      0      0  3  0x40014200                idle0
     1  165749      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 80546 (syz-executor) thread 0xffff80003c42c028 (387870)
Process 6277 (syz-executor) thread 0xffff80002a28f240 (90946)
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10257  11129K   12468K 166960K     17343        0
            pcb    19     20K      22K 166960K      1052        0
         rtable   244     15K      16K 166960K      1473        0
             pf    39     18K   67486K 166960K       601        0
         ifaddr    40      8K      10K 166960K       328        0
        ifgroup    60      2K       3K 166960K       648        0
         sysctl     4      1K       9K 166960K        40        0
       counters    70     37K      38K 166960K       830        0
       ioctlops     0      0K       5K 166960K      2699        0
            iov     0      0K      24K 166960K       267        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1480     93K      94K 166960K      5436        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        94        0
         VM map     2      1K       1K 166960K         2        0
            sem    57    115K     134K 166960K       459        0
        dirhash    12      2K       3K 166960K       111        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     236K 166960K      4981        0
          sigio     1      0K       0K 166960K       184        0
           proc    75    115K     180K 166960K      1224        0
        subproc    72      4K       4K 166960K       126        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       728        0
       in_multi    80      6K       7K 166960K       357        0
    ether_multi     1      0K       0K 166960K        47        0
            mrt     1      0K       0K 166960K        40        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   265   1182K    1182K 166960K       265        0
           exec     0      0K       1K 166960K      1409        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K        18        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   285    162K     218K 166960K     47613        0
       UVM aobj   109      8K       8K 166960K       122        0
     pinsyscall    43     86K     110K 166960K      6262        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     2      0K       1K 166960K       366        0
            NDP    13      0K       2K 166960K       242        0
           temp   159   8661K    8756K 166960K    400983        0
         kqueue    13     20K      36K 166960K       969        0
      SYN cache     2      8K      16K 166960K         3        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      532    0      528     5     3     2     2     0     8    1
rtentry    176      464    0      376     6     0     6     6     0     8    0
unpcb      144     3799    0     3781    33    32     1     9     0     8    0
syncache   336       19    0       19     9     8     1     1     0     8    1
tcpqe       32        1   13        1     1     1     0     1     0     8    0
tcpcb      736     1727    0     1710    41    39     2     9     0     8    0
arp        136       80    0       60     1     0     1     1     0     8    0
inpcb      328     6405    0     6382    68    60     8    14     0     8    4
nd6        152       56    0       40     1     0     1     1     0     8    0
pkpcb       40       49    0       49    15    14     1     1     0     8    1
kcovpl      48       14    0        6     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1192     310    0      309     6     5     1     1     0     8    0
pppxif     1504      42    0       42    14    14     0     1     0     8    0
pfstscr     40        4    0        4     1     1     0     1     0     8    0
pffrag     232       36    0       34     5     4     1     1     0   482    0
pffrnode    88       28    0       26     5     4     1     1     0     8    0
pffrent     40      195    0      193     6     5     1     1     0     8    0
pfosfp      40     1429    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1429    0      714    21     0    21    21     0     8    0
pfrktable  1344      29    0       29     3     3     0     1     0     8    0
pfstitem    24      324    0      229     1     0     1     1     0     8    0
pfstkey    128      327    0      232     4     0     4     4     0     8    0
pfstate    384      326    0      231    13     2    11    11     0     8    0
pfrule     1344      23    0       18     2     1     1     2     0     8    0
rttmr      136        9    0        7     6     5     1     1     0     8    0
art_heap8  4096       6    0        2     6     2     4     5     0     8    0
art_heap4  256     1594    0     1203    36     9    27    29     0     8    0
art_table   40     1600    0     1205     5     0     5     5     0     8    0
art_node    32      455    0      378     2     0     2     2     0     8    0
sysvmsgpl   40       28    0       20     1     0     1     1     0     8    0
semupl     112        9    0        9     7     7     0     1     0     8    0
semapl     112      410    0      355     4     2     2     2     0     8    0
shmpl      112      119    0       13     4     0     4     4     0     8    0
dirhash    1024      83    0       66     3     0     3     3     0     8    0
dino2pl    256    10961    0     9439    96     0    96    96     0     8    0
ffsino     296    10961    0     9439   118     0   118   118     0     8    0
nchpl      144    17834    0    16114    65     0    65    65     0     8    0
rtmask      32       37    0       37    10    10     0     1     0     8    0
vnodes     216     5926    0        0   330     0   330   330     0     8    0
namei      1024   61782    0    61781     8     7     1     2     0     8    0
percpumem   16      430    0      380     1     0     1     1     0     8    0
kstatmem   264      424    0      394     5     2     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72       17    0       17    11    11     0     1     0     8    0
scxspl     216   111767    0   111767    22    20     2     8     1     8    2
plimitpl   152     1754    0     1734     1     0     1     1     0     8    0
sigapl     424     5256    0     5207     8     1     7     7     0     8    0
knotepl    120      864    0        0    24     0    24    24     0     8    0
kqueuepl   224     2063    0     2054    24    23     1     5     0     8    0
pipepl     344      804    0      776    12     9     3     6     0     8    0
fdescpl    528     5219    0     5187     3     0     3     3     0     8    0
filepl     160    37481    0    37246    62    48    14    19     0     8    0
lockfpl    104     2611    0     2609     7     5     2     4     0     8    1
lockfspl    48      797    0      795     1     0     1     1     0     8    0
sessionpl  144       39    0       30     1     0     1     1     0     8    0
pgrppl      48      125    0      108     1     0     1     1     0     8    0
ucredpl    104     6861    0     6847     1     0     1     1     0     8    0
zombiepl   144     6605    0     6602     4     3     1     1     0     8    0
processpl  1232    5256    0     5207     6     1     5     5     0     8    0
procpl     664    13516    0    13456     7     0     7     7     0     8    0
sosppl     176       31    0       31     9     9     0     1     0     8    0
sockpl     752    10941    0    10896   133   121    12    25     0     8    5
mcl64k     65536     28    0        0     4     0     4     4     0     8    0
mcl16k     16384      6    0        0     1     0     1     1     0     8    0
mcl12k     12288      7    0        0     1     0     1     1     0     8    0
mcl9k      9216       3    0        0     1     0     1     1     0     8    0
mcl8k      8192       8    0        0     1     0     1     1     0     8    0
mcl4k      4096     134    0        0    16     0    16    16     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      82    0        0     7     2     5     7     0     8    0
mtagpl      96       15    0        0     1     0     1     1     0     8    0
mbufpl     256     5578    0        0   338     0   338   338     0     8    0
bufpl      280    45409    0    39272   439     0   439   439     0     8    0
anonpl      32    26392    0        0   213     1   212   212     0   246    0
amapchunkpl 152  171669    0   170828   119    80    39    45     0   158    5
amappl16   200    18635    0    17774   121    67    54    59     0     8    1
amappl15   192        7    0        6     2     1     1     1     0     8    0
amappl14   184       39    0       39     4     4     0     1     0     8    0
amappl13   176      507    0      502     1     0     1     1     0     8    0
amappl12   168     5648    0     5604     3     0     3     3     0     8    0
amappl11   160       14    0       13     2     1     1     1     0     8    0
amappl10   152       54    0       39     1     0     1     1     0     8    0
amappl9    144      248    0      248     1     1     0     1     0     8    0
amappl8    136       30    0       27     1     0     1     1     0     8    0
amappl7    128      104    0      103     1     0     1     1     0     8    0
amappl6    120      362    0      348     1     0     1     1     0     8    0
amappl5    112       90    0       79     1     0     1     1     0     8    0
amappl4    104      496    0      465     2     0     2     2     0     8    0
amappl3     96    29515    0    29407     3     0     3     3     0     8    0
amappl2     88     5402    0     5321     3     0     3     3     0     8    0
amappl1     80    31978    0    31384    23     2    21    23     0     8    0
amappl      88    45918    0    45711     6     0     6     6     0    92    0
uvmvnodes   80     5926    0        0   121     0   121   121     0     8    0
dma65536   65536      1    0        1     1     0     1     1     0     8    1
dma32768   32768      2    0        2     2     2     0     1     0     8    0
dma16384   16384      1    0        1     1     1     0     1     0     8    0
dma8192    8192       1    0        1     1     1     0     1     0     8    0
dma4096    4096       4    0        4     3     3     0     1     0     8    0
dma2048    2048       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      257    0      257     4     4     0     1     0     8    0
dma64       64        7    0        7     2     2     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72      121    0       13     2     0     2     2     0     8    0
uaddrrnd    24     5219    0     5187     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     5219    0     5187     1     0     1     1     0     8    0
vmmpekpl   168    39281    0    39220     4     1     3     3     0     8    0
vmmpepl    168   335669    0   332768   206    60   146   165     0   357    2
vmsppl     488     5218    0     5187     7     2     5     5     0     8    0
rwobjpl     80    90498    0    82648   184    12   172   175     0     8    0
pdppl      4096   10445    0    10374   139    68    71    85     0     8    0
pvpl        32    37206    0        0   298     0   298   298     0   265    0
pmappl     256     5218    0     5187     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      720    0      145    17     0    17    17     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
icmp_mtudisc_timeout(fffffd806b7d9220,0) at icmp_mtudisc_timeout+291
rt_timer_queue_flush(ffffffff839920f8) at rt_timer_queue_flush+653
ip_sysctl(ffff80002a362bec,1,0,ffff80002a362c18,200000001300,4) at ip_sysctl+2125
net_sysctl(ffff80002a362be4,3,0,ffff80002a362c18,200000001300,4,4fc739380812767b) at net_sysctl+1614
sys_sysctl(ffff80003c42c028,ffff80002a362d50,ffff80002a362ca0) at sys_sysctl+997
syscall(ffff80002a362d50) at syscall+3028
Xsyscall() at Xsyscall+296
end of kernel
end trace frame: 0xeefae5174f0, count: -7
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+39:  addq    $8,%rsp
ddb{1}> trace
x86_ipi_db(ffff8000299edff0) at x86_ipi_db+39
x86_ipi_handler() at x86_ipi_handler+217
Xresume_lapic_ipi() at Xresume_lapic_ipi+39
acpicpu_idle() at acpicpu_idle+1111
sched_idle(ffff8000299edff0) at sched_idle+913
end trace frame: 0x0, count: -5

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/03 13:58 openbsd 0214ec5c7fc4 e6c64ba8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: icmp_mtudisc_timeout
2025/08/12 02:52 openbsd 3ae9e49f3bd9 c06e8995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: icmp_mtudisc_timeout
2025/08/02 09:15 openbsd 4c5c4401a4d8 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: icmp_mtudisc_timeout
2025/07/27 17:55 openbsd 7b0d12c26b01 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: icmp_mtudisc_timeout
2025/07/25 17:22 openbsd c5645c128364 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: icmp_mtudisc_timeout
2025/07/16 23:23 openbsd 9ce74a582983 3cda49cf .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: icmp_mtudisc_timeout
* Struck through repros no longer work on HEAD.