syzbot


uvm_fault: dt_ioctl_record_stop (3)

Status: upstream: reported on 2026/03/24 13:23
Reported-by: syzbot+d82ab40d2bcc01c05570@syzkaller.appspotmail.com
First crash: 31d, last: 2h50m
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: dt_ioctl_record_stop (2) -1 4591 31d 267d 3/3 fixed on 2026/03/24 12:14
openbsd uvm_fault: dt_ioctl_record_stop -1 1306 267d 384d 3/3 fixed on 2025/08/01 00:18

Sample crash report:
uvm_fault(0xfffffd806e8c73e0, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      dt_ioctl_record_stop+0x108:     movq    0(%r14),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*216029  50751      0           0  0x4000000    0K syz-executor
dt_ioctl_record_stop(ffff80000168f000) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,1,2000,ffff8000fffe9a10) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff8000fffe9a10) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff80002a2a2740) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd80601246f0,1,fffffd80097fd1a0,ffff8000fffe9a10) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806d253618,ffff8000fffe9a10) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806d253618,ffff8000fffe9a10) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffffd806d253618,ffff8000fffe9a10) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffd806d253618,ffff8000fffe9a10) at closef+0x192 sys/kern/kern_descrip.c:1265
sys_closefrom(ffff8000fffe9a10,ffff80002a2a2a10,ffff80002a2a2960) at sys_closefrom+0x13c sys/kern/kern_descrip.c:1471
syscall(ffff80002a2a2a10) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2a2a10) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa225852c410, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffffd806e8c73e0, 0x0, 0, 1) -> e
ddb{0}> trace
dt_ioctl_record_stop(ffff80000168f000) at dt_ioctl_record_stop+0x108 sys/dev/dt/dt_dev.c:593
dtclose(11e5f,1,2000,ffff8000fffe9a10) at dtclose+0x109 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline]
dtclose(11e5f,1,2000,ffff8000fffe9a10) at dtclose+0x109 sys/dev/dt/dt_dev.c:239
spec_close(ffff80002a2a2740) at spec_close+0x466 sys/kern/spec_vnops.c:-1
VOP_CLOSE(fffffd80601246f0,1,fffffd80097fd1a0,ffff8000fffe9a10) at VOP_CLOSE+0x132 sys/kern/vfs_vops.c:156
vn_closefile(fffffd806d253618,ffff8000fffe9a10) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:298 [inline]
vn_closefile(fffffd806d253618,ffff8000fffe9a10) at vn_closefile+0x12b sys/kern/vfs_vnops.c:621
fdrop(fffffd806d253618,ffff8000fffe9a10) at fdrop+0x121 sys/kern/kern_descrip.c:1281
closef(fffffd806d253618,ffff8000fffe9a10) at closef+0x192 sys/kern/kern_descrip.c:1265
sys_closefrom(ffff8000fffe9a10,ffff80002a2a2a10,ffff80002a2a2960) at sys_closefrom+0x13c sys/kern/kern_descrip.c:1471
syscall(ffff80002a2a2a10) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a2a2a10) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa225852c410, count: -10
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a2a2670
rbx                              0x1
rdx                                0
rcx               0xffff8000fffe9a10
rax               0xffffffff8386e578    dt_prov_syscall
r8                0xffffffff8154f380    uvm_map_inentry_sp
r9                               0x1
r10               0x2749a48ad6e46eff
r11               0x152b2b720ef4f1c5
r12                                0
r13                                0
r14                                0
r15               0xffff800000c4a500
rip               0xffffffff810c5058    dt_ioctl_record_stop+0x108
cs                               0x8
rflags                       0x10207    __ALIGN_SIZE+0xf207
rsp               0xffff80002a2a2640
ss                              0x10
dt_ioctl_record_stop+0x108:     movq    0(%r14),%r14
ddb{0}> 

Crashes (26):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/25 06:16 openbsd 2f70c1a437bc 9c2d0995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/04/24 20:52 openbsd 9aeaae004919 1c2b9291 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/04/24 14:48 openbsd 9aeaae004919 1c2b9291 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/04/24 08:36 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/04/21 08:03 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/04/16 23:00 openbsd 203548908adb 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/04/09 12:29 openbsd b0cdb9e75fee 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/04/09 04:16 openbsd b0cdb9e75fee 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/04/05 19:44 openbsd bc22b0de1984 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/04/01 11:28 openbsd 9f2496a89535 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/31 19:29 openbsd 077f28b4c6a4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/31 15:43 openbsd 077f28b4c6a4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/31 12:27 openbsd 077f28b4c6a4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: dt_ioctl_record_stop
2026/03/27 19:57 openbsd f3ad7971a235 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/27 18:50 openbsd f3ad7971a235 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/27 16:35 openbsd f3ad7971a235 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/27 05:41 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/26 16:57 openbsd 9c6370df4fcd 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/26 11:42 openbsd 84b7e477fd25 c6143aac .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/25 19:29 openbsd ee1bf64f5bae 4367a094 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/25 07:28 openbsd 87dc1fa97379 35e4ff71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/25 06:26 openbsd 87dc1fa97379 35e4ff71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/25 05:59 openbsd 87dc1fa97379 35e4ff71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/24 19:10 openbsd 7348976a6ac6 74e70d19 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/24 15:31 openbsd 7348976a6ac6 74e70d19 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
2026/03/24 13:23 openbsd 7348976a6ac6 74e70d19 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: dt_ioctl_record_stop
* Struck through repros no longer work on HEAD.