syzbot


uvm_fault: checkalias (2)

Status: upstream: reported on 2026/01/25 01:20
Reported-by: syzbot+8cc1e70cfa72da226f48@syzkaller.appspotmail.com
First crash: 57d, last: 2d10h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: checkalias -1 8 587d 712d 0/3 auto-obsoleted due to no activity on 2024/11/11 03:51

Sample crash report:
login: uvm_fault(0xfffffd807ece9000, 0x18, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      checkalias+0xb7:        movl    0x18(%r13),%ebx
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*392161  55202      0         0x2          0    0  syz-executor
checkalias(fffffd805e8d3ea0,ffff8000,ffff800000c68400) at checkalias+0xb7 sys/kern/vfs_subr.c:574
ffs_vinit(ffff800000c68400,ffff80002a7f1480) at ffs_vinit+0x111 sys/ufs/ffs/ffs_subr.c:-1
ffs_vget(ffff800000c68400,cc00,ffff80002a7f1550) at ffs_vget+0x406 sys/ufs/ffs/ffs_vfsops.c:1285
ufs_lookup() at ufs_lookup+0x16ad sys/ufs/ufs/ufs_lookup.c:573
VOP_LOOKUP(fffffd805e8d3630,ffff80002a7f17e0,ffff80002a7f1810) at VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
vfs_lookup(ffff80002a7f17b0) at vfs_lookup+0x961 sys/kern/vfs_lookup.c:567
namei(ffff80002a7f17b0) at namei+0x7ca sys/kern/vfs_lookup.c:250
dofstatat(ffff80002a786540,ffffff9c,72bf9c6acd60,72bf9c6ad160,2) at dofstatat+0xe4 sys/kern/vfs_syscalls.c:2105
syscall(ffff80002a7f1a10) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7f1a10) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x72bf9c6ad210, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xfffffd807ece9000, 0x18, 0, 1) -> e
ddb> trace
checkalias(fffffd805e8d3ea0,ffff8000,ffff800000c68400) at checkalias+0xb7 sys/kern/vfs_subr.c:574
ffs_vinit(ffff800000c68400,ffff80002a7f1480) at ffs_vinit+0x111 sys/ufs/ffs/ffs_subr.c:-1
ffs_vget(ffff800000c68400,cc00,ffff80002a7f1550) at ffs_vget+0x406 sys/ufs/ffs/ffs_vfsops.c:1285
ufs_lookup() at ufs_lookup+0x16ad sys/ufs/ufs/ufs_lookup.c:573
VOP_LOOKUP(fffffd805e8d3630,ffff80002a7f17e0,ffff80002a7f1810) at VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
vfs_lookup(ffff80002a7f17b0) at vfs_lookup+0x961 sys/kern/vfs_lookup.c:567
namei(ffff80002a7f17b0) at namei+0x7ca sys/kern/vfs_lookup.c:250
dofstatat(ffff80002a786540,ffffff9c,72bf9c6acd60,72bf9c6ad160,2) at dofstatat+0xe4 sys/kern/vfs_syscalls.c:2105
syscall(ffff80002a7f1a10) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a7f1a10) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x72bf9c6ad210, count: -10
ddb> show registers
rdi                              0x2
rsi                              0x1
rbp               0xffff80002a7f13e0
rbx               0xfffffd800bc95d00
rdx                                0
rcx               0xffffffff839c5700    speclisth
rax                                0
r8                0xffffffffffffffff
r9                                 0
r10               0x8239b0042972f2ff
r11               0x42b3064939d9f93b
r12                       0xffff8000
r13                                0
r14                       0xffff8000
r15               0xfffffd806c5b0cd8
rip               0xffffffff829cf717    checkalias+0xb7
cs                               0x8
rflags                       0x10286    __ALIGN_SIZE+0xf286
rsp               0xffff80002a7f1370
ss                              0x10
checkalias+0xb7:        movl    0x18(%r13),%ebx
ddb> show proc
PROC (syz-executor) tid=392161 pid=55202 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a7862a8,0xffff80002a787778
    process=0xffff80002a7bc010 user=0xffff80002a7ec000, vmspace=0xfffffd807ece9000
    estcpu=36, cpticks=3, pctcpu=0.0, user=0, sys=3, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 74256  194633  25597      0  2           0                syz-executor
 74256  184746  25597      0  3   0x4000080  fsleep        syz-executor
 62101  378745  61218      0  3        0x80  fsleep        syz-executor
 62101  506520  61218      0  2   0x4000c80                syz-executor
 62101  183094  61218      0  2   0x4000c80                syz-executor
 96201  475079  53713      0  3        0x80  fsleep        syz-executor
 96201   56250  53713      0  3   0x4000080  fifor         syz-executor
 25530  199498   1253      0  3        0x80  fsleep        syz-executor
 25530  329524   1253      0  3   0x4000000  biowait       syz-executor
 86368  208596  33200      0  3        0x80  fsleep        syz-executor
 86368  203080  33200      0  3   0x4000080  kqsel         syz-executor
 39898  494472  95460      0  3        0x80  fsleep        syz-executor
 39898   61909  95460      0  3   0x4000080  ttyin         syz-executor
 40876  333174  76872      0  3        0x80  fsleep        syz-executor
 40876  355461  76872      0  2   0x4000000                syz-executor
 26822  455274      1      0  3    0x100083  ttyin         getty
 85368  180645      0      0  3     0x14200  acct          acct
 18505  298440      0      0  3     0x14280  nfsidl        nfsio
 49277  380974      0      0  3     0x14280  nfsidl        nfsio
 37692  379156      0      0  3     0x14280  nfsidl        nfsio
 98041  363681      0      0  3     0x14280  nfsidl        nfsio
  1433  278472      0      0  3     0x14280  nfsidl        nfsio
 98288  407158      0      0  3     0x14280  nfsidl        nfsio
 69438  100138      0      0  3     0x14280  nfsidl        nfsio
 78557  220869      0      0  3     0x14280  nfsidl        nfsio
 92332  233351      0      0  3     0x14280  nfsidl        nfsio
 23486  121277      0      0  3     0x14280  nfsidl        nfsio
 14343  213529      0      0  3     0x14280  nfsidl        nfsio
 64220  444998      0      0  3     0x14280  nfsidl        nfsio
 21675  143176      0      0  3     0x14280  nfsidl        nfsio
 50524  348219      0      0  3     0x14280  nfsidl        nfsio
 10374    6925      0      0  3     0x14280  nfsidl        nfsio
  1829  435455      0      0  3     0x14280  nfsidl        nfsio
 27417  376311      0      0  3     0x14280  nfsidl        nfsio
 95795  488153      0      0  3     0x14280  nfsidl        nfsio
 69543  299965      0      0  3     0x14280  nfsidl        nfsio
 95524  262316      0      0  3     0x14280  nfsidl        nfsio
 33200  270642  53381      0  2       0xc82                syz-executor
  1253   79771  53381      0  2       0xc82                syz-executor
 53713  423388  53381      0  2       0xc82                syz-executor
 95460  283886  53381      0  2       0xc82                syz-executor
 61218  343103  53381      0  2       0xc82                syz-executor
 25597  170152  53381      0  3        0x82  nanoslp       syz-executor
 76872  424395  53381      0  3        0x82  wait          syz-executor
*55202  392161  53381      0  7         0x2                syz-executor
 53381  276213  89755      0  3        0x82  kqread        syz-executor
 89755      24  73163      0  3    0x10008a  sigsusp       ksh
 73163  336435  35610      0  3        0x98  kqread        sshd-session
 35610  285673    400      0  3        0x92  kqread        sshd-session
   400  271783      1      0  3        0x88  kqread        sshd
 94817  400181  49698     73  3   0x1100090  kqread        syslogd
 49698  159582      1      0  3    0x100082  sbwait        syslogd
 90240  378307      1      0  3    0x100080  kqread        resolvd
 20994  148943  66327     77  3    0x100092  kqread        dhcpleased
  2920  491139  66327     77  3    0x100092  kqread        dhcpleased
 66327  186506      1      0  3        0x80  kqread        dhcpleased
 28750  479309      0      0  3     0x14200  bored         smr
 88351  384410      0      0  2     0x14200                zerothread
 79208  403145      0      0  3     0x14200  aiodoned      aiodoned
 36132   35497      0      0  3     0x14200  syncer        update
 27486  228148      0      0  3     0x14200  cleaner       cleaner
 96326  126831      0      0  3     0x14200  reaper        reaper
 46610  472577      0      0  3     0x14200  pgdaemon      pagedaemon
 24670   16453      0      0  3     0x14200  bored         viomb
 73525  295437      0      0  3  0x40014200  acpi0         acpi0
 35608  289835      0      0  3     0x14200  bored         softnet0
 91795  302987      0      0  3     0x14200  bored         systqmp
 93175  158479      0      0  3     0x14200  bored         systq
 61691  214406      0      0  3  0x40014200  tmoslp        softclock
  6440  365607      0      0  3  0x40014200                idle0
     1  433562      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11048  12168K   13354K 166960K     13165        0
            pcb    17     16K      18K 166960K       162        0
         rtable   232      8K       9K 166960K       439        0
             pf    34     13K      17K 166960K        55        0
         ifaddr    41      7K       7K 166960K        56        0
        ifgroup    57      2K       2K 166960K        70        0
         sysctl     4      1K       9K 166960K        13        0
       counters    34     17K      18K 166960K        43        0
       ioctlops     0      0K       4K 166960K        89        0
            iov     1      0K      16K 166960K        17        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1489     94K      94K 166960K      1922        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         9        0
         VM map     2      1K       1K 166960K         2        0
            sem     9      2K       2K 166960K        17        0
        dirhash    12      2K       2K 166960K        21        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    17     61K     236K 166960K       495        0
          sigio     0      0K       0K 166960K         6        0
           proc    60     59K     100K 166960K       539        0
        subproc    72      4K       4K 166960K        72        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       196        0
       in_multi    91      6K       7K 166960K       108        0
    ether_multi     1      0K       0K 166960K         1        0
            mrt     0      0K       0K 166960K        15        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    85    387K     387K 166960K        85        0
           exec     0      0K       1K 166960K       398        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   213    150K     168K 166960K      6020        0
       UVM aobj    17      6K       6K 166960K        20        0
     pinsyscall    38     76K      93K 166960K      1587        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       1K 166960K        33        0
            NDP    12      0K       1K 166960K        33        0
           temp    44   9068K    9132K 166960K     15235        0
         kqueue    14     22K      33K 166960K        95        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120       72    0       69     1     0     1     1     0     8    0
rtentry    136      125    0       32     4     0     4     4     0     8    0
unpcb      144      391    0      374     6     0     6     6     0     8    5
syncache   336        5    0        5     1     0     1     1     0     8    1
tcpqe       32        2    0        2     1     0     1     1     0     8    1
tcpcb      736      195    0      189     4     0     4     4     0     8    3
arp         96       20    0        3     1     0     1     1     0     8    0
ipq         40        2    0        0     1     0     1     1     0     8    0
ipqe        40        2    0        0     1     0     1     1     0     8    0
inpcb      328      601    0      592     7     0     7     7     0     8    5
ip6q        72        1    0        0     1     0     1     1     0     8    0
ip6af       40        2    0        0     1     0     1     1     0     8    0
nd6        112       27    0        6     1     0     1     1     0     8    0
pkpcb       40        2    0        2     1     0     1     1     0     8    1
kcovpl      48        8    0        0     1     0     1     1     0     8    0
ppxss      1072       8    0        8     1     0     1     1     0     8    1
pppxif     1384       1    0        1     1     0     1     1     0     8    1
pfrktable  1344       1    0        1     1     0     1     1     0     8    1
pfanchor   1288       1    0        0     1     0     1     1     0     8    0
pfstitem    24        2    0        0     1     0     1     1     0     8    0
pfstkey    128        2    0        0     1     0     1     1     0     8    0
pfstate    384        1    0        0     1     0     1     1     0     8    0
pfrule     1360       4    0        4     1     0     1     1     0     8    1
art_heap8  4096       4    0        0     4     0     4     4     0     8    0
art_heap4  256      563    0      153    31     0    31    31     0     8    2
art_table   40      567    0      153     5     0     5     5     0     8    0
art_node    32      125    0       41     1     0     1     1     0     8    0
sysvmsgpl   40        1    0        0     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl     112       13    0        6     1     0     1     1     0     8    0
shmpl      112       14    0        2     1     0     1     1     0     8    0
dirhash    1024      23    0        6     3     0     3     3     0     8    0
dino2pl    256     2263    0      799    92     0    92    92     0     8    0
ffsino     256     2263    0      799    92     0    92    92     0     8    0
nchpl      144     2936    0     1237    64     0    64    64     0     8    0
rtmask      32        2    0        2     1     0     1     1     0     8    1
vnodes     216     2754    0        0   153     0   153   153     0     8    0
vnodes: pool(0xffffffff839c8438:vnodes): page inconsistency: page 0x0; at page head addr 0xfffffd806c5b0f90 (p 0xfffffd806c5b0000)
namei      1024    9416    0     9415     2     0     2     2     0     8    1
vcpupl     3904       3    0        1     1     0     1     1     0     8    0
vmpool     808        3    0        1     1     0     1     1     0     8    0
kstatmem   264       34    0       10     2     0     2     2     0     8    0
scsiplug    72        3    0        3     1     0     1     1     0     8    1
scxspl     216    11675    0    11674     8     0     8     8     1     8    7
plimitpl   152      166    0      147     1     0     1     1     0     8    0
sigapl     424      798    0      735     8     0     8     8     0     8    0
knotepl    120    21600    0    21553    16     5    11    16     0     8    8
kqueuepl   184      144    0      133     3     0     3     3     0     8    2
pipepl     304      201    0      174     8     0     8     8     0     8    5
fdescpl    448      764    0      735     5     0     5     5     0     8    1
filepl     120     4547    0     4330    13     0    13    13     0     8    6
lockfpl    104      195    0      192     1     0     1     1     0     8    0
lockfspl    48       96    0       93     1     0     1     1     0     8    0
sessionpl  144       24    0       16     1     0     1     1     0     8    0
pgrppl      48       35    0       19     1     0     1     1     0     8    0
ucredpl    104      607    0      596     1     0     1     1     0     8    0
zombiepl   144      735    0      735     1     0     1     1     0     8    1
processpl  1152     798    0      735     5     0     5     5     0     8    0
procpl     664     1339    0     1268     7     0     7     7     0     8    0
sosppl     176        1    0        1     1     0     1     1     0     8    1
sockpl     552     1074    0     1045    12     1    11    12     0     8    8
mcl64k     65536     15    0       15     1     0     1     1     0     8    1
mcl8k      8192       6    0        6     1     0     1     1     0     8    1
mcl4k      4096    2924    0     2870    15     0    15    15     0     8    7
mcl2k      2048     456    0      452     3     0     3     3     0     8    1
mtagpl      96       11    0        5     1     0     1     1     0     8    0
mbufpl     256     7868    0     7672    19     0    19    19     0     8    4
bufpl      280     3993    0      103   278     0   278   278     0     8    0
anonpl      24   145278    0   137495    57     0    57    57     0   187    9
amapchunkpl 152   19826    0    19375    33     0    33    33     0   158   14
amappl16   200     2631    0     2310    23     6    17    17     0     8    0
amappl15   192        5    0        5     1     0     1     1     0     8    1
amappl14   184      404    0      403     1     0     1     1     0     8    0
amappl13   176      144    0      134     1     0     1     1     0     8    0
amappl12   168     1004    0      976     2     0     2     2     0     8    0
amappl11   160        4    0        4     1     0     1     1     0     8    1
amappl10   152       87    0       77     1     0     1     1     0     8    0
amappl9    144      271    0      270     1     0     1     1     0     8    0
amappl8    136       95    0       93     1     0     1     1     0     8    0
amappl7    128      157    0      146     1     0     1     1     0     8    0
amappl6    120      148    0      147     1     0     1     1     0     8    0
amappl5    112      160    0      153     1     0     1     1     0     8    0
amappl4    104      260    0      244     1     0     1     1     0     8    0
amappl3     96     3664    0     3561     3     0     3     3     0     8    0
amappl2     88      534    0      478     2     0     2     2     0     8    0
amappl1     80    11407    0    10864    15     0    15    15     0     8    2
amappl      88     5254    0     5103     4     0     4     4     0    92    0
uvmvnodes   80      108    0        0     3     0     3     3     0     8    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      256    0      256     1     0     1     1     0     8    1
dma64       64        7    0        7     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       19    0       18     1     0     1     1     0     8    0
aobjpl      72       19    0        3     1     0     1     1     0     8    0
uaddrrnd    24      764    0      735     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      764    0      735     1     0     1     1     0     8    0
vmmpekpl   168     8218    0     8185     2     0     2     2     0     8    0
vmmpepl    168    56880    0    54826   102     0   102   102     0   357   10
vmsppl     368      763    0      735     4     0     4     4     0     8    1
rwobjpl     40    18400    0    17154    15     0    15    15     0     8    2
pdppl      4096    1540    0     1474   101    32    69    80     0     8    3
pvpl        32   366644    0   353590   131     0   131   131     0   265   24
pmappl     216      766    0      736     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      383    0       32    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
checkalias(fffffd805e8d3ea0,ffff8000,ffff800000c68400) at checkalias+0xb7 sys/kern/vfs_subr.c:574
ffs_vinit(ffff800000c68400,ffff80002a7f1480) at ffs_vinit+0x111 sys/ufs/ffs/ffs_subr.c:-1
ffs_vget(ffff800000c68400,cc00,ffff80002a7f1550) at ffs_vget+0x406 sys/ufs/ffs/ffs_vfsops.c:1285
ufs_lookup() at ufs_lookup+0x16ad sys/ufs/ufs/ufs_lookup.c:573
VOP_LOOKUP(fffffd805e8d3630,ffff80002a7f17e0,ffff80002a7f1810) at VOPConnection to us-central1-ssh-serialport.googleapis.com closed by remote host.

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/21 00:54 openbsd 65032adb4937 85bf2a64 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: checkalias
2026/03/19 09:00 openbsd cf7d68fc25cd 0199f9a1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: checkalias
2026/03/16 13:24 openbsd 15ef65f2835f 64e21424 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: checkalias
2026/01/25 01:20 openbsd 12762e433761 40acda8a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: checkalias
* Struck through repros no longer work on HEAD.