syzbot


protection_fault: done_flush (4)

Status: upstream: reported on 2025/11/16 13:03
Reported-by: syzbot+f386e2f64711877025a6@syzkaller.appspotmail.com
First crash: 17d, last: 3h07m
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd protection_fault: done_flush (3) -1 5 470d 483d 0/3 auto-obsoleted due to no activity on 2024/11/18 20:44
openbsd protection_fault: done_flush -1 81 1076d 1433d 0/3 auto-obsoleted due to no activity on 2023/03/23 00:50
openbsd protection_fault: done_flush (2) -1 C 55 566d 753d 0/3 auto-obsoleted due to no activity on 2024/07/05 09:14

Sample crash report:
kernel: protection fault trap, code=0
Stopped at      done_flush+0x38:        movl    %eax,%dr6
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
the kernel did not panic
ddb{0}> trace
end trace frame: 0x0, count: -1
ddb{0}> show registers
rdi                           0x6c14    __ALIGN_SIZE+0x5c14
rsi               0xffff8000fffd5b18
rbp                                0
rbx                       0x756e6547
rdx                       0x49656e69
rcx                       0x6c65746e
rax                   0xc5a8ae57121b
r8                                 0
r9                           0x10000    __ALIGN_SIZE+0xf000
r10                                0
r11                                0
r12                                0
r13                                0
r14                                0
r15                                0
rip               0xffffffff811954bb    done_flush+0x38
cs                               0x8
rflags                       0x10046    __ALIGN_SIZE+0xf046
rsp               0xffff80003a7f2478
ss                              0x10
done_flush+0x38:        movl    %eax,%dr6
ddb{0}> show proc
PROC (syz-executor) tid=130255 pid=50410 tcnt=3 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=76, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000fffe8a80,0xffff8000fffe8560
    process=0xffff8000fffe7040 user=0xffff80003a7ed000, vmspace=0xfffffd8073fd55c0
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  7162  337010  75789      0  2           0                syz-executor
 50410  282978   6564      0  2           0                syz-executor
*50410  130255   6564      0  7   0x4000000                syz-executor
 50410  209921   6564      0  2   0x4000000                syz-executor
  1762    4263  75808      0  7           0                syz-executor
  1762  211764  75808      0  2   0x4000080                syz-executor
 46089  465060  35172      0  2           0                syz-executor
 46089  436253  35172      0  3   0x4000080  fsleep        syz-executor
 69328  148882  78083      0  3      0x3000  suspend       syz-executor
 69328  349293  78083      0  2   0x4081000                syz-executor
 69328  291707  78083      0  2   0x4081000                syz-executor
 69328  118395  78083      0  2   0x4081000                syz-executor
 77777  290090  55263      0  3        0x80  fsleep        syz-executor
 77777    9323  55263      0  3   0x4000080  msgwait       syz-executor
 96108  515855      1      0  3    0x100083  ttyin         getty
 78083  495514  34050      0  3        0x82  nanoslp       syz-executor
 75789  167456  34050      0  3        0x82  nanoslp       syz-executor
 75808  360808  34050      0  3        0x82  nanoslp       syz-executor
 35172  324765  34050      0  3        0x82  nanoslp       syz-executor
  6564  247327  34050      0  3        0x82  nanoslp       syz-executor
 73916   95196  34050      0  3        0x82  wait          syz-executor
 55263  102468  34050      0  3        0x82  nanoslp       syz-executor
 52081  218139  34050      0  3        0x82  wait          syz-executor
 34050   14927  44047      0  3        0x82  kqread        syz-executor
 44047  116461  23848      0  3    0x10008a  sigsusp       ksh
 23848  128126   5337      0  3        0x98  kqread        sshd-session
  5337  358274  11205      0  3        0x92  kqread        sshd-session
 11205   58154      1      0  3        0x88  kqread        sshd
 14533  483614  66068     74  3   0x1100092  bpf           pflogd
 66068  434507      1      0  3        0x80  sbwait        pflogd
 74031  497921  81744     73  3   0x1100090  kqread        syslogd
 81744  253427      1      0  3    0x100082  sbwait        syslogd
 10163  445074      1      0  3    0x100080  kqread        resolvd
 17969   75815  86782     77  3    0x100092  kqread        dhcpleased
  7617  145249  86782     77  3    0x100092  kqread        dhcpleased
 86782  502594      1      0  3        0x80  kqread        dhcpleased
 82163  512470      0      0  3     0x14200  bored         smr
 15660  329162      0      0  2     0x14200                zerothread
 65054  339316      0      0  3     0x14200  aiodoned      aiodoned
 33020  234958      0      0  3     0x14200  syncer        update
  2806  334697      0      0  3     0x14200  cleaner       cleaner
 71658  128472      0      0  3     0x14200  reaper        reaper
 92262  384087      0      0  3     0x14200  pgdaemon      pagedaemon
 44561  126659      0      0  3     0x14200  bored         viomb
 60658  114533      0      0  3  0x40014200  acpi0         acpi0
 62792  443813      0      0  3  0x40014200                idle1
 35936  160073      0      0  3     0x14200  bored         softnet1
  8092  140871      0      0  3     0x14200  bored         softnet0
 54765  132187      0      0  3     0x14200  smrbar        systqmp
 28573  113050      0      0  3     0x14200  bored         systq
 90722  463294      0      0  3     0x14200  tmoslp        softclockmp
  6755  141400      0      0  3  0x40014200  tmoslp        softclock
 74135  320392      0      0  3  0x40014200                idle0
     1   97973      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 50410 (syz-executor) thread 0xffff8000fffe94e0 (130255)
exclusive rwlock vcpu r = 0 (0xffff8000fffd5870)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  vm_run+0xa2 sys/arch/amd64/amd64/vmm_machdep.c:-1
#3  vmmioctl+0x337 sys/dev/vmm/vmm.c:254
#4  VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#5  vn_ioctl+0xf8 sys/kern/vfs_vnops.c:531
#6  sys_ioctl+0x674 sys/kern/sys_generic.c:-1
#7  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#7  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:775
#8  Xsyscall+0x128
Process 54765 (systqmp) thread 0xffff8000ffffe298 (132187)
shared rwlock systqmp r = 0 (0xffffffff837f8248)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10235  11040K   11271K 166960K     12590        0
            pcb    17     16K      18K 166960K       431        0
         rtable   254     12K      12K 166960K       683        0
             pf    41     19K      81K 166960K       296        0
         ifaddr    43      8K       9K 166960K       145        0
        ifgroup    59      2K       3K 166960K       260        0
         sysctl     4      1K       9K 166960K        23        0
       counters    72     37K      38K 166960K       278        0
       ioctlops     0      0K       4K 166960K      2080        0
            iov     0      0K      28K 166960K       130        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1399     88K      89K 166960K      2623        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        22        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        99        0
        dirhash    69     12K      15K 166960K      1434        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    18     65K     236K 166960K      1846        0
          sigio     0      0K       0K 166960K        49        0
           proc    73    115K     180K 166960K       846        0
        subproc    72      4K       4K 166960K       118        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     2      0K       0K 166960K       421        0
       in_multi    96      7K       7K 166960K       207        0
    ether_multi     1      0K       0K 166960K        15        0
            mrt     2      0K       0K 166960K        19        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   259   1155K    1155K 166960K       259        0
           exec     0      0K       1K 166960K       797        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   254    160K     174K 166960K     18381        0
       UVM aobj    45     14K      14K 166960K        51        0
     pinsyscall    43     86K     101K 166960K      3130        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       124        0
            NDP    13      0K       2K 166960K       103        0
           temp    81   8676K    8742K 166960K     92693        0
         kqueue    14     22K      32K 166960K       354        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      280    0      277     5     4     1     3     0     8    0
rtentry    176      207    0      102     6     0     6     6     0     8    0
unpcb      144     1314    0     1295    13     7     6     6     0     8    5
syncache   336       10    0       10     6     5     1     1     0     8    1
tcpqe       32        1    0        1     1     1     0     1     0     8    0
tcpcb      736      792    0      786    23    19     4     7     0     8    3
arp        136       31    0       13     1     0     1     1     0     8    0
inpcb      328     2206    0     2196    19    14     5     8     0     8    4
nd6        152       43    0       16     2     0     2     2     0     8    0
pkpcb       40        9    0        9     4     3     1     1     0     8    1
kcovpl      48       13    0        5     1     0     1     1     0     8    0
mppekey    1024       1    0        1     1     1     0     1     0     8    0
ppxss      1192      78    0       78     2     1     1     1     0     8    1
pppxif     1504      12    0       12     3     2     1     1     0     8    1
pfstscr     40        5    0        4     1     0     1     1     0     8    0
pffrag     232       55    0       44     1     0     1     1     0   482    0
pffrnode    88       15    0        6     1     0     1     1     0     8    0
pffrent     40      154    0      143     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       1    0        1     1     1     0     1     0     8    0
pfstitem    24      129    0       69     1     0     1     1     0     8    0
pfstkey    128      136    0       76     3     0     3     3     0     8    0
pfstate    448      132    0       73     7     0     7     7     0     8    0
pfrule     1344      27    0       22     2     1     1     2     0     8    0
rttmr      136        4    0        4     2     1     1     1     0     8    1
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      902    0      458    38     8    30    31     0     8    2
art_table   40      905    0      458     6     1     5     6     0     8    0
art_node    32      207    0      113     1     0     1     1     0     8    0
sysvmsgpl   40       16    0       12     1     0     1     1     0     8    0
semupl     112        3    0        3     3     3     0     1     0     8    0
semapl     112       94    0       84     1     0     1     1     0     8    0
shmpl      112       43    0        5     2     0     2     2     0     8    0
dirhash    1024     494    0      458     7     1     6     6     0     8    1
dino2pl    256     4764    0     3244    96     0    96    96     0     8    0
ffsino     296     4764    0     3244   118     0   118   118     0     8    0
nchpl      144     7251    0     5536    65     0    65    65     0     8    0
rtmask      32       16    0       16     5     4     1     1     0     8    1
vnodes     216     5411    0        0   301     0   301   301     0     8    0
namei      1024   26571    0    26571     1     0     1     1     0     8    1
percpumem   16      154    0      103     1     0     1     1     0     8    0
vcpupl     3968       4    0        0     1     0     1     1     0     8    0
vmpool     840        5    0        1     1     0     1     1     0     8    0
kstatmem   264      156    0      128     5     2     3     3     0     8    0
scsiplug    72        7    0        7     4     3     1     1     0     8    1
scxspl     216    49448    0    49448    12    10     2     8     1     8    2
plimitpl   152      684    0      667     1     0     1     1     0     8    0
sigapl     424     2136    0     2088     7     1     6     7     0     8    0
knotepl    120      611    0        0    18     0    18    18     0     8    0
kqueuepl   224      904    0      894    13    10     3     5     0     8    1
pipepl     344      308    0      281     4     1     3     4     0     8    0
fdescpl    528     2119    0     2087     3     0     3     3     0     8    0
filepl     160    14812    0    14591    29    14    15    19     0     8    4
lockfpl    104      617    0      615     1     0     1     1     0     8    0
lockfspl    48      238    0      236     1     0     1     1     0     8    0
sessionpl  144       37    0       28     1     0     1     1     0     8    0
pgrppl      48       67    0       50     1     0     1     1     0     8    0
ucredpl    104     2391    0     2377     1     0     1     1     0     8    0
zombiepl   144     2091    0     2088     1     0     1     1     0     8    0
processpl  1232    2136    0     2088     5     1     4     5     0     8    0
procpl     664     4840    0     4784     6     0     6     6     0     8    0
sosppl     176       19    0       19     3     3     0     1     0     8    0
sockpl     752     3998    0     3966    36    24    12    17     0     8    7
mcl64k     65536     18    0        0     3     0     3     3     0     8    0
mcl16k     16384      1    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096     123    0        0    16     0    16    16     0     8    0
mcl2k2     2112       1    0        0     1     0     1     1     0     8    0
mcl2k      2048      46    0        0     6     0     6     6     0     8    0
mtagpl      96        6    0        0     1     0     1     1     0     8    0
mbufpl     256     1453    0        0    91     0    91    91     0     8    0
bufpl      280    20776    0    14640   439     0   439   439     0     8    0
anonpl      32    15876    0        0   128     0   128   128     0   246    0
amapchunkpl 152   62454    0    61859    47    10    37    37     0   158   11
amappl16   200     8943    0     8678    62    35    27    36     0     8    0
amappl15   192        7    0        7     1     1     0     1     0     8    0
amappl14   184        7    0        7     1     1     0     1     0     8    0
amappl13   176      492    0      491     1     0     1     1     0     8    0
amappl12   168     2551    0     2509     2     0     2     2     0     8    0
amappl11   160        5    0        4     1     0     1     1     0     8    0
amappl10   152       65    0       51     1     0     1     1     0     8    0
amappl9    144      245    0      244     2     1     1     1     0     8    0
amappl8    136       32    0       28     1     0     1     1     0     8    0
amappl7    128       96    0       95     1     0     1     1     0     8    0
amappl6    120      350    0      337     1     0     1     1     0     8    0
amappl5    112       91    0       80     1     0     1     1     0     8    0
amappl4    104      497    0      467     1     0     1     1     0     8    0
amappl3     96    12428    0    12316     5     1     4     4     0     8    0
amappl2     88      666    0      604     2     0     2     2     0     8    0
amappl1     80    18574    0    17980    14     0    14    14     0     8    0
amappl      88    17243    0    17066     5     0     5     5     0    92    0
uvmvnodes   80      164    0        0     4     0     4     4     0     8    0
dma65536   65536      1    0        1     1     1     0     1     0     8    0
dma4096    4096       3    0        3     3     3     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma512     512        1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      255    0      255     3     2     1     1     0     8    1
dma64       64        9    0        9     3     3     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       50    0        6     1     0     1     1     0     8    0
uaddrrnd    24     2119    0     2087     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2119    0     2087     1     0     1     1     0     8    0
vmmpekpl   168    17279    0    17233     3     0     3     3     0     8    0
vmmpepl    168   142797    0   140571   124    15   109   115     0   357    2
vmsppl     488     2118    0     2087     9     4     5     5     0     8    1
rwobjpl     80    40097    0    38709    40     5    35    36     0     8    0
pdppl      4096    4256    0     4180   112    36    76    84     0     8    0
pvpl        32    22844    0        0   187     2   185   185     0   265    0
pmappl     256     2123    0     2088     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      422    0       76    11     0    11    11     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
end trace frame: 0x0, count: -1
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
ddb{1}> trace
x86_ipi_db(ffff8000299ddff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
end of kernel
end trace frame: 0x7b5e25dc9c90, count: -3

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/03 18:52 openbsd fcb10a4bf1a4 98d1f71f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: done_flush
2025/12/03 16:14 openbsd fcb10a4bf1a4 98d1f71f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: done_flush
2025/12/03 13:02 openbsd fcb10a4bf1a4 98d1f71f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: done_flush
2025/12/03 03:58 openbsd cbd41aff2336 d4611817 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: done_flush
2025/11/26 12:33 openbsd 856b2687a9ff c116feb4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: done_flush
2025/11/24 01:56 openbsd f4c39256adbf 4fb8ef37 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: done_flush
2025/11/18 19:24 openbsd ae8b598acb72 ef766cd7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: done_flush
2025/11/17 16:26 openbsd a49642845568 c1ade9dd .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: done_flush
2025/11/17 06:18 openbsd 59cee6408d9e f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore protection_fault: done_flush
2025/11/16 13:03 openbsd 9c41abc406e3 f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main protection_fault: done_flush
* Struck through repros no longer work on HEAD.