syzbot
uvm_fault: sys_shmat (3)
Status:
upstream: reported on 2026/06/24 23:01
Reported-by: syzbot+f5d2ec16c4993e11ed9e@syzkaller.appspotmail.com
First crash: 33d, last: 2h36m
Sample crash report:
uvm_fault(0xfffff3000b1f7988, 0x0, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at sys_shmat+0x453: movq 0(%r15),%rdi
TID PID UID PRFLAGS PFLAGS CPU COMMAND
376004 20275 0 0 0 0 syz-executor
* 4867 48541 0 0 0x4000000 1K syz-executor
sys_shmat(ffff80003a7a4020,ffff80002a28eb40,ffff80002a28ea90) at sys_shmat+0x453 sys/kern/sysv_shm.c:292
syscall(ffff80002a28eb40) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a28eb40) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x699c3288680, count: 12
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xfffff3000b1f7988, 0x0, 0, 1) -> e
ddb{1}> show kasan
No such command
ddb{1}> trace
sys_shmat(ffff80003a7a4020,ffff80002a28eb40,ffff80002a28ea90) at sys_shmat+0x453 sys/kern/sysv_shm.c:292
syscall(ffff80002a28eb40) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a28eb40) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x699c3288680, count: -3
ddb{1}> show registers
rdi 0xffff80002b780000
rsi 0x8ce
rbp 0xffff80002a28ea60
rbx 0xfffff300649e4ee0
rdx 0xffff80002b780000
rcx 0x1
rax 0x1
r8 0x180
r9 0xfffff300097fd270
r10 0
r11 0xb057bdffe094df2e
r12 0xffff80003a7a4020
r13 0xffff8000015fd010
r14 0x3
r15 0
rip 0xffffffff82bf3ee3 sys_shmat+0x453
cs 0x8
rflags 0x10246 __ALIGN_SIZE+0xf246
rsp 0xffff80002a28e9d0
ss 0x10
sys_shmat+0x453: movq 0(%r15),%rdi
ddb{1}> show proc
PROC (syz-executor) tid=4867 pid=48541 tcnt=3 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=86, usrpri=86, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80003a7a54e0,0xffff80003a7a4560
process=0xffff800045ff21c0 user=0xffff80002a289000, vmspace=0xfffff3000b1f7988
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb{1}> ps
PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND
13210 522705 28613 0 2 0 0 syz-executor
13210 37631 28613 0 3 0 0x4000080 fsleep syz-executor
20275 376004 77909 0 7 0 0 syz-executor
20275 24619 77909 0 2 0 0x4000000 syz-executor
20275 175674 77909 0 3 0 0x4000080 fsleep syz-executor
63003 111572 64415 0 3 0 0x80 nanoslp syz-executor
63003 73998 64415 0 3 0 0x4000080 fsleep syz-executor
63003 480824 64415 0 3 0 0x4000080 fsleep syz-executor
48541 390339 40689 0 2 0 0 syz-executor
48541 68908 40689 0 2 0 0x4000000 syz-executor
*48541 4867 40689 0 7 0 0x4000000 syz-executor
12648 184017 94790 0 2 0 0x1 syz-executor
12648 513354 94790 0 3 0 0x4000080 fsleep syz-executor
12648 204877 94790 0 3 0 0x4000080 fsleep syz-executor
11333 214805 54950 -1 2 0x10 0x1 syz-executor
11333 235236 54950 -1 3 0x10 0x4000080 fsleep syz-executor
11333 516750 54950 -1 3 0x10 0x4000080 fsleep syz-executor
78924 500093 7676 0 2 0x2 0 syz-executor
82049 134000 21576 0 3 0 0x80 nanoslp syz-executor
82049 35890 21576 0 3 0 0x4000080 fsleep syz-executor
82049 225757 21576 0 3 0 0x4000080 fsleep syz-executor
85410 291673 1 0 3 0 0x80 nanoslp init
77909 108875 7676 0 3 0x2 0x80 nanoslp syz-executor
54950 197371 7676 0 3 0x2 0x80 nanoslp syz-executor
94790 410545 7676 0 3 0x2 0x80 nanoslp syz-executor
28613 63061 7676 0 3 0x2 0x80 nanoslp syz-executor
40689 472642 7676 0 3 0x2 0x80 nanoslp syz-executor
21576 141493 7676 0 3 0x2 0x80 nanoslp syz-executor
64415 351959 7676 0 3 0x2 0x80 nanoslp syz-executor
7676 492614 1 0 3 0x2 0x80 kqread syz-executor
81521 165531 0 0 3 0x14000 0x200 bored smr
54212 316801 0 0 2 0x14000 0x200 zerothread
25435 210355 0 0 3 0x14000 0x200 aiodoned aiodoned
82545 52881 0 0 3 0x14000 0x200 syncer update
27609 232908 0 0 3 0x14000 0x200 cleaner cleaner
55492 119915 0 0 3 0x14000 0x200 reaper reaper
2390 434653 0 0 3 0x14000 0x200 pgdaemon pagedaemon
35478 203503 0 0 3 0x14000 0x200 bored viomb
67517 477613 0 0 3 0x14000 0x40000200 acpi0 acpi0
74321 187249 0 0 3 0x14000 0x40000200 idle1
34476 282254 0 0 3 0x14000 0x200 bored softnet1
39810 381459 0 0 3 0x14000 0x200 bored softnet0
29705 313498 0 0 3 0x14000 0x200 bored systqmp
16340 296454 0 0 3 0x14000 0x200 bored systq
30559 477354 0 0 3 0x14000 0x200 tmoslp softclockmp
61975 250748 0 0 3 0x14000 0x40000200 tmoslp softclock
94035 311925 0 0 3 0x14000 0x40000200 idle0
1 207342 0 0 3 0x2 0x80 wait init
0 0 -1 0 3 0x10000 0x200 scheduler swapper
ddb{1}> show all locks
Process 20275 (syz-executor) thread 0xffff80003a7a42b8 (24619)
exclusive rwlock fdlock r = 0 (0xffff80003a7aa280)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2 doopenat+0x179 sys/kern/vfs_syscalls.c:1130
#3 sys_open+0x59 sys/kern/vfs_syscalls.c:1065
#4 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#5 Xsyscall+0x128
Process 48541 (syz-executor) thread 0xffff800045ffc2a0 (390339)
exclusive rwlock vmmaplk r = 0 (0xfffff3000b1f7a88)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2 vm_map_lock_ln+0x12e sys/uvm/uvm_map.c:5170
#3 uvm_map_protect+0xe0 sys/uvm/uvm_map.c:3075
#4 sys_mprotect+0x351 sys/uvm/uvm_mmap.c:590
#5 syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#5 syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
#6 Xsyscall+0x128
Process 48541 (syz-executor) thread 0xffff80003a7a4020 (4867)
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a157c0)
#0 witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0 witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1 __mp_acquire_count+0x58 sys/kern/kern_lock.c:-1
#2 malloc+0xe3 sys/kern/kern_malloc.c:175
#3 sys_shmat+0x9f sys/kern/sysv_shm.c:-1
#4 syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4 syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
#5 Xsyscall+0x128
ddb{1}> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 11049 12086K 12211K 166960K 12307 0
pcb 17 12K 12K 166960K 43 0
rtable 198 7K 8K 166960K 395 0
pf 31 17K 24K 166960K 78 0
ifaddr 34 5K 7K 166960K 53 0
ifgroup 47 2K 2K 166960K 70 0
sysctl 3 1K 9K 166960K 8 0
counters 66 36K 37K 166960K 92 0
ioctlops 0 0K 4K 166960K 1517 0
iov 0 0K 2K 166960K 2 0
mount 1 1K 1K 166960K 1 0
log 1 0K 0K 166960K 5 0
vnodes 1326 83K 83K 166960K 1527 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 3 5K 5K 166960K 4 0
VM map 2 1K 1K 166960K 2 0
sem 12 0K 0K 166960K 23 0
dirhash 12 2K 2K 166960K 18 0
ACPI 1734 201K 291K 166960K 11964 0
file desc 16 61K 89K 166960K 275 0
proc 12 17K 163K 166960K 577 0
subproc 72 4K 5K 166960K 99 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 17 0
in_multi 73 5K 7K 166960K 100 0
ether_multi 1 0K 0K 166960K 1 0
mrt 1 0K 0K 166960K 10 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 61 281K 281K 166960K 61 0
exec 0 0K 1K 166960K 419 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 134 78K 169K 166960K 4632 0
UVM aobj 3 2K 2K 166960K 3 0
pinsyscall 18 36K 102K 166960K 1506 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 2 0
NDP 10 0K 2K 166960K 34 0
temp 37 9115K 9179K 166960K 11326 0
kqueue 1 2K 28K 166960K 46 0
SYN cache 2 16K 16K 166960K 2 0
ddb{1}> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache 128 28 0 0 1 0 1 1 0 8 0
rtpcb 120 47 0 47 2 1 1 1 0 8 1
rtentry 176 113 0 28 6 0 6 6 0 8 0
unpcb 144 115 0 114 2 1 1 1 0 8 0
syncache 336 8 0 8 1 1 0 1 0 8 0
tcpqe 32 1 0 1 1 1 0 1 0 8 0
tcpcb 736 67 0 62 4 3 1 4 0 8 0
arp 136 18 0 4 1 0 1 1 0 8 0
inpcb 328 225 0 219 7 6 1 7 0 8 0
nd6 152 25 0 8 1 0 1 1 0 8 0
pkpcb 40 3 0 3 1 0 1 1 0 8 1
kcovpl 48 10 0 3 1 0 1 1 0 8 0
ppxss 1192 10 0 10 2 1 1 1 0 8 1
pffrag 232 1 0 0 1 0 1 1 0 482 0
pffrnode 88 1 0 0 1 0 1 1 0 8 0
pffrent 40 1 0 0 1 0 1 1 0 8 0
pfosfp 40 1428 0 1005 5 0 5 5 0 8 0
pfosfpen 112 1428 0 714 21 0 21 21 0 8 0
pfrktable 1344 2 0 2 2 1 1 1 0 8 1
pfanchor 1288 5 0 0 1 0 1 1 0 8 0
pfstitem 24 42 0 0 1 0 1 1 0 8 0
pfstkey 128 42 0 0 2 0 2 2 0 8 0
pfstate 448 41 0 0 5 0 5 5 0 8 0
pfrule 1360 25 0 19 2 0 2 2 0 8 0
art_heap8 4096 1 0 0 1 0 1 1 0 8 0
art_heap4 256 486 0 104 31 0 31 31 0 8 1
art_table 40 487 0 104 5 0 5 5 0 8 0
art_node 32 113 0 35 1 0 1 1 0 8 0
sysvmsgpl 40 2 0 1 1 0 1 1 0 8 0
semupl 112 1 0 1 1 1 0 1 0 8 0
semapl 72 21 0 11 1 0 1 1 0 8 0
shmpl 112 1 0 0 1 0 1 1 0 8 0
dirhash 1024 21 0 4 3 0 3 3 0 8 0
dino2pl 256 1833 0 359 93 0 93 93 0 8 0
ffsino 296 1833 0 359 115 1 114 115 0 8 0
nchpl 144 2187 0 477 64 0 64 64 0 8 0
rtmask 32 4 0 4 2 1 1 1 0 8 1
vnodes 216 2037 0 0 114 0 114 114 0 8 0
namei 1024 6983 0 6983 2 1 1 2 0 8 1
percpumem 16 62 0 13 1 0 1 1 0 8 0
acpiwqpl 32 1 0 1 1 0 1 1 1 8 1
kstatmem 264 39 0 16 2 0 2 2 0 8 0
scsiplug 72 1 0 1 1 0 1 1 0 8 1
scxspl 216 10087 0 10087 5 4 1 3 1 8 1
plimitpl 152 49 0 38 1 0 1 1 0 8 0
sigapl 424 606 0 571 7 1 6 7 0 8 0
knotepl 120 262 0 0 8 0 8 8 0 8 0
kqueuepl 224 65 0 60 1 0 1 1 0 8 0
pipepl 344 154 0 127 3 0 3 3 0 8 0
fdescpl 528 590 0 571 3 0 3 3 0 8 0
filepl 160 2548 0 2374 11 2 9 11 0 8 0
lockfpl 104 71 0 67 1 0 1 1 0 8 0
lockfspl 48 34 0 30 1 0 1 1 0 8 0
sessionpl 144 31 0 29 1 0 1 1 0 8 0
pgrppl 48 42 0 32 1 0 1 1 0 8 0
ucredpl 104 220 0 216 1 0 1 1 0 8 0
zombiepl 144 629 0 629 1 0 1 1 0 8 1
processpl 1232 606 0 571 5 1 4 5 0 8 0
procpl 664 854 0 805 6 1 5 6 0 8 0
sockpl 752 393 0 386 9 7 2 8 0 8 0
mcl64k 65536 6 0 0 1 0 1 1 0 8 0
mcl16k 16384 2 0 0 1 0 1 1 0 8 0
mcl8k 8192 2
Struck through repros no longer work on HEAD.