protection_fault: done_flush (4)

0 views
Skip to first unread message

syzbot

unread,
Nov 16, 2025, 8:03:34 AMNov 16
to syzkaller-o...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 9c41abc406e3 bootblock softraid code was assuming struct d..
git tree: openbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15aa5212580000
kernel config: https://syzkaller.appspot.com/x/.config?x=1bc15e68cd2a49e5
dashboard link: https://syzkaller.appspot.com/bug?extid=f386e2f64711877025a6

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1cfced3ea869/disk-9c41abc4.raw.xz
bsd.gdb: https://storage.googleapis.com/syzbot-assets/1c996ebd4af1/bsd-9c41abc4.gdb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bddf106110e6/kernel-9c41abc4.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f386e2...@syzkaller.appspotmail.com

kernel: protection fault trap, code=0
Stopped at done_flush+0x38: movl %eax,%dr6
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
the kernel did not panic
ddb> trace
end trace frame: 0x0, count: -1
ddb> show registers
rdi 0x6c14 __ALIGN_SIZE+0x5c14
rsi 0xffff80003ca54a70
rbp 0
rbx 0x756e6547
rdx 0x49656e69
rcx 0x6c65746e
rax 0xffffffffffffffc2
r8 0
r9 0x10000 __ALIGN_SIZE+0xf000
r10 0
r11 0
r12 0
r13 0
r14 0
r15 0
rip 0xffffffff82c85c0b done_flush+0x38
cs 0x8
rflags 0x10046 __ALIGN_SIZE+0xf046
rsp 0xffff80003c939888
ss 0x10
done_flush+0x38: movl %eax,%dr6
ddb> show proc
PROC (syz-executor) tid=83663 pid=17216 tcnt=2 stat=onproc
flags process=0 proc=4000000<THREAD>
runpri=32, usrpri=50, slppri=32, nice=20
wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
forw=0xffffffffffffffff, list=0xffff80002a7bd770,0xffffffff83919df0
process=0xffff8000ffff8018 user=0xffff80003c934000, vmspace=0xfffffd8074d3f748
estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> ps
PID TID PPID UID S FLAGS WAIT COMMAND
17216 487290 90591 0 2 0 syz-executor
*17216 83663 90591 0 7 0x4000000 syz-executor
30648 307393 44721 0 2 0 syz-executor
30648 235210 44721 0 2 0x4000000 syz-executor
71460 186288 26792 0 2 0x82000 syz-executor
71460 283146 26792 0 3 0x4002000 suspend syz-executor
82499 480632 22534 0 3 0x80 nanoslp syz-executor
82499 445864 22534 0 3 0x4000080 pipewr syz-executor
82499 425586 22534 0 3 0x4000080 pipewr syz-executor
82499 218536 22534 0 3 0x4000080 fsleep syz-executor
94994 516722 49416 0 3 0x80 nanoslp syz-executor
94994 35309 49416 0 3 0x4000080 fsleep syz-executor
94994 171128 49416 0 3 0x4000080 fsleep syz-executor
61340 493716 54643 0 2 0 syz-executor
61340 348439 54643 0 3 0x4000080 fsleep syz-executor
61340 466501 54643 0 3 0x4000080 fsleep syz-executor
61340 156358 54643 0 3 0x4000080 fsleep syz-executor
87110 444333 42227 0 2 0 syz-executor
87110 3584 42227 0 3 0x4000080 lockf syz-executor
87110 407340 42227 0 3 0x4000080 fsleep syz-executor
62053 309836 50422 0 3 0x82 piperd syz-executor
49416 448567 50422 0 3 0x82 nanoslp syz-executor
42227 516958 50422 0 3 0x82 nanoslp syz-executor
26792 134097 50422 0 3 0x82 nanoslp syz-executor
22534 184920 50422 0 3 0x82 nanoslp syz-executor
44721 218477 50422 0 3 0x82 nanoslp syz-executor
54643 153701 50422 0 3 0x82 nanoslp syz-executor
90591 109242 50422 0 3 0x82 nanoslp syz-executor
50422 203441 42996 0 2 0x2 syz-executor
42996 441465 10738 0 3 0x10008a sigsusp ksh
10738 505425 94052 0 3 0x98 kqread sshd-session
94052 473945 61543 0 3 0x92 kqread sshd-session
32156 28991 1 0 3 0x100083 ttyin getty
61543 499247 1 0 3 0x88 kqread sshd
64071 79495 94691 73 3 0x1100090 kqread syslogd
94691 51652 1 0 3 0x100082 sbwait syslogd
4211 39238 1 0 3 0x100080 kqread resolvd
16546 132484 845 77 3 0x100092 kqread dhcpleased
41128 482651 845 77 3 0x100092 kqread dhcpleased
845 36109 1 0 3 0x80 kqread dhcpleased
71064 10109 0 0 3 0x14200 bored smr
11515 350278 0 0 2 0x14200 zerothread
27916 69606 0 0 3 0x14200 aiodoned aiodoned
52014 310835 0 0 3 0x14200 syncer update
20869 108218 0 0 3 0x14200 cleaner cleaner
33950 326892 0 0 3 0x14200 reaper reaper
76839 414831 0 0 3 0x14200 pgdaemon pagedaemon
76205 189985 0 0 3 0x14200 bored viomb
81006 239690 0 0 3 0x40014200 acpi0 acpi0
96660 473207 0 0 3 0x14200 bored softnet0
84208 442012 0 0 3 0x14200 smrbar systqmp
17397 444427 0 0 3 0x14200 bored systq
19351 373430 0 0 3 0x40014200 tmoslp softclock
78546 467430 0 0 3 0x40014200 idle0
1 146272 0 0 3 0x82 wait init
0 0 -1 0 3 0x10010200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
Type InUse MemUse HighUse Limit Requests Type Lim
devbuf 10187 11379K 11446K 166960K 11965 0
pcb 19 12K 12K 166960K 79 0
rtable 188 7K 8K 166960K 413 0
pf 26 12K 16K 166960K 54 0
ifaddr 34 6K 7K 166960K 59 0
ifgroup 42 1K 2K 166960K 77 0
sysctl 1 1K 9K 166960K 5 0
counters 30 17K 18K 166960K 45 0
ioctlops 0 0K 4K 166960K 79 0
iov 0 0K 12K 166960K 17 0
mount 1 1K 1K 166960K 1 0
log 0 0K 0K 166960K 4 0
vnodes 1407 89K 89K 166960K 1710 0
UFS quota 1 32K 32K 166960K 1 0
UFS mount 5 36K 36K 166960K 5 0
shm 2 1K 9K 166960K 9 0
VM map 2 1K 1K 166960K 2 0
sem 10 0K 0K 166960K 15 0
dirhash 12 2K 2K 166960K 12 0
ACPI 1692 195K 286K 166960K 12470 0
file desc 17 61K 89K 166960K 415 0
sigio 0 0K 0K 166960K 73 0
proc 60 59K 83K 166960K 503 0
subproc 72 4K 4K 166960K 72 0
NFS srvsock 1 0K 0K 166960K 1 0
NFS daemon 1 16K 16K 166960K 1 0
ip_moptions 0 0K 0K 166960K 21 0
in_multi 77 5K 7K 166960K 117 0
ether_multi 1 0K 0K 166960K 5 0
mrt 1 0K 0K 166960K 4 0
ISOFS mount 1 32K 32K 166960K 1 0
MSDOSFS mount 1 16K 16K 166960K 1 0
ttys 85 387K 387K 166960K 85 0
exec 0 0K 1K 166960K 382 0
fusefs mount 1 32K 32K 166960K 1 0
tdb 3 0K 0K 166960K 3 0
VM swap 8 62K 64K 166960K 10 0
UVM amap 239 147K 158K 166960K 5404 0
UVM aobj 17 6K 6K 166960K 17 0
pinsyscall 38 76K 92K 166960K 1483 0
memdesc 1 4K 4K 166960K 1 0
crypto data 1 1K 1K 166960K 1 0
ip6_options 0 0K 0K 166960K 15 0
NDP 9 0K 2K 166960K 35 0
temp 43 8652K 8716K 166960K 18809 0
kqueue 13 20K 26K 166960K 75 0
SYN cache 2 16K 16K 166960K 2 0
ddb> show all pools
Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb 120 58 0 55 1 0 1 1 0 8 0
rtentry 136 124 0 46 4 0 4 4 0 8 0
unpcb 144 377 0 356 5 0 5 5 0 8 4
syncache 336 4 0 4 1 0 1 1 0 8 1
tcpqe 32 2 0 2 1 0 1 1 0 8 1
tcpcb 736 141 0 134 7 0 7 7 0 8 6
arp 96 20 0 6 1 0 1 1 0 8 0
ipq 40 2 0 0 1 0 1 1 0 8 0
ipqe 40 2 0 0 1 0 1 1 0 8 0
inpcb 328 388 0 375 7 0 7 7 0 8 5
ip6q 72 1 0 0 1 0 1 1 0 8 0
ip6af 40 1 0 0 1 0 1 1 0 8 0
nd6 112 25 0 7 1 0 1 1 0 8 0
pkpcb 40 2 0 1 1 0 1 1 0 8 0
kcovpl 48 8 0 0 1 0 1 1 0 8 0
mppekey 1024 1 0 1 1 0 1 1 0 8 1
ppxss 1072 9 0 9 1 0 1 1 0 8 1
pppxif 1384 2 0 2 1 0 1 1 0 8 1
pfrule 1344 1 0 1 1 0 1 1 0 8 1
rttmr 136 1 0 1 1 0 1 1 0 8 1
art_heap8 4096 2 0 0 2 0 2 2 0 8 0
art_heap4 256 558 0 158 33 0 33 33 0 8 6
art_table 40 560 0 158 6 0 6 6 0 8 0
art_node 32 123 0 43 1 0 1 1 0 8 0
sysvmsgpl 40 41 0 5 1 0 1 1 0 8 0
semapl 112 11 0 3 1 0 1 1 0 8 0
shmpl 112 12 0 0 1 0 1 1 0 8 0
dirhash 1024 17 0 0 3 0 3 3 0 8 0
dino2pl 256 2090 0 587 95 0 95 95 0 8 0
ffsino 256 2090 0 587 95 0 95 95 0 8 0
nchpl 144 2699 0 1007 63 0 63 63 0 8 0
rtmask 32 1 0 1 1 0 1 1 0 8 1
vnodes 216 2421 0 0 135 0 135 135 0 8 0
namei 1024 8180 0 8180 2 0 2 2 0 8 2
vcpupl 3904 2 0 0 1 0 1 1 0 8 0
vmpool 800 2 0 0 1 0 1 1 0 8 0
kstatmem 264 38 0 20 2 0 2 2 0 8 0
scsiplug 72 2 0 2 1 0 1 1 0 8 1
scxspl 216 13637 0 13637 8 0 8 8 1 8 8
plimitpl 152 135 0 116 1 0 1 1 0 8 0
sigapl 424 703 0 661 6 0 6 6 0 8 1
knotepl 120 14118 0 14071 9 0 9 9 0 8 7
kqueuepl 184 154 0 145 1 0 1 1 0 8 0
pipepl 304 171 0 142 5 0 5 5 0 8 2
fdescpl 448 688 0 659 5 0 5 5 0 8 1
filepl 120 3622 0 3387 12 0 12 12 0 8 4
lockfpl 104 125 0 119 1 0 1 1 0 8 0
lockfspl 48 58 0 54 1 0 1 1 0 8 0
sessionpl 144 21 0 13 1 0 1 1 0 8 0
pgrppl 48 36 0 20 1 0 1 1 0 8 0
ucredpl 104 448 0 437 1 0 1 1 0 8 0
zombiepl 144 661 0 661 1 0 1 1 0 8 1
processpl 1152 703 0 661 4 0 4 4 0 8 0
procpl 664 1150 0 1095 6 0 6 6 0 8 1
sockpl 552 869 0 831 13 2 11 13 0 8 8
mcl64k 65536 12 0 12 1 0 1 1 0 8 1
mcl8k 8192 6 0 6 1 0 1 1 0 8 1
mcl4k 4096 2857 0 2800 14 0 14 14 0 8 6
mcl2k2 2112 1 0 1 1 0 1 1 0 8 1
mcl2k 2048 598 0 595 2 0 2 2 0 8 1
mtagpl 96 88 0 80 2 0 2 2 0 8 0
mbufpl 256 6968 0 6728 25 0 25 25 0 8 6
bufpl 280 7946 0 1725 445 0 445 445 0 8 0
anonpl 24 150053 0 146853 45 0 45 45 0 187 12
amapchunkpl 152 17722 0 17221 32 0 32 32 0 158 8
amappl16 200 3363 0 3332 24 12 12 15 0 8 8
amappl15 192 10 0 10 1 0 1 1 0 8 1
amappl14 184 3 0 3 1 0 1 1 0 8 1
amappl13 176 405 0 404 1 0 1 1 0 8 0
amappl12 168 1025 0 987 2 0 2 2 0 8 0
amappl11 160 10 0 10 1 0 1 1 0 8 1
amappl10 152 43 0 33 1 0 1 1 0 8 0
amappl9 144 275 0 274 1 0 1 1 0 8 0
amappl8 136 36 0 35 1 0 1 1 0 8 0
amappl7 128 78 0 76 1 0 1 1 0 8 0
amappl6 120 269 0 258 1 0 1 1 0 8 0
amappl5 112 70 0 62 1 0 1 1 0 8 0
amappl4 104 374 0 349 1 0 1 1 0 8 0
amappl3 96 2798 0 2704 3 0 3 3 0 8 0
amappl2 88 803 0 730 2 0 2 2 0 8 0
amappl1 80 9796 0 9259 12 0 12 12 0 8 0
amappl 88 4655 0 4486 5 0 5 5 0 92 0
uvmvnodes 80 107 0 0 3 0 3 3 0 8 0
dma4096 4096 1 0 1 1 0 1 1 0 8 1
dma1024 1024 1 0 0 1 0 1 1 0 8 0
dma256 256 6 0 6 1 0 1 1 0 8 1
dma128 128 254 0 254 1 0 1 1 0 8 1
dma64 64 7 0 7 1 0 1 1 0 8 1
dma32 32 7 0 7 1 0 1 1 0 8 1
dma16 16 18 0 17 1 0 1 1 0 8 0
aobjpl 72 16 0 0 1 0 1 1 0 8 0
uaddrrnd 24 688 0 659 1 0 1 1 0 8 0
uaddrbest 32 2 0 0 1 0 1 1 0 8 0
uaddr 24 688 0 659 1 0 1 1 0 8 0
vmmpekpl 168 7091 0 7061 2 0 2 2 0 8 0
vmmpepl 168 51260 0 49458 91 0 91 91 0 357 10
vmsppl 368 687 0 659 4 0 4 4 0 8 1
rwobjpl 40 17200 0 16223 13 0 13 13 0 8 1
pdppl 4096 1387 0 1320 96 28 68 79 0 8 1
pvpl 32 346783 0 337966 110 0 110 110 0 265 19
pmappl 216 689 0 659 2 0 2 2 0 8 0
extentpl 40 45 0 27 1 0 1 1 0 8 0
phpool 112 390 0 28 11 0 11 11 0 8 0
ddb> machine ddbcpu 0
No such command
ddb> trace
end trace frame: 0x0, count: -1
ddb> machine ddbcpu 1
No such command
ddb> trace
end trace frame: 0x0, count: -1


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages