>Synopsis: use-after-free of struct process in reaper(): prsignal() on
>poisoned ps_pptr
>Category: kernel
>Environment:
System : OpenBSD 8.0
Details : OpenBSD 8.0 (GENERIC.MP) #84: Tue Oct 6 23:13:49 MDT 2026
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
Architecture: OpenBSD.amd64
Machine : amd64
>Description:
Panic under a burst of short-lived processes. Seen twice on #84
(2026-10-07 and 2026-10-09); the first left no trace, this is the
second.
ddb.panic=0, so the trace printed and the reboot then hung at
"syncing disks...", leaving no dump. Transcribed from a photo of
the console:
fatal protection fault in supervisor mode
trap type 4 code 0 rip ffffffff8170cfc3 cs 8 rflags 10246 cr2
846c71b6040 cpl 0 rsp ffff800079e7cf10
gsbase 0xffff800079663ff0 kgsbase 0x0
panic: trap type 4, code=0, pc=ffffffff8170cfc3
Starting stack trace...
panic(ffffffff826d7a5f) at panic+0x170
kerntrap(ffff800079e7ce60) at kerntrap+0x15d
alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b
mtx_enter(deadbeefdeadbfcf) at mtx_enter+0x43
prsignal(deadbeefdeadbeef,14) at prsignal+0x26
reaper(ffff800079e7fca0) at reaper+0x1de
end trace frame: 0x0, count: 251
End of stack trace.
syncing disks...
This looks like reaper() posting SIGCHLD (0x14) to pr->ps_pptr after
the struct it reads had been freed and poisoned. The faulting pointer
is exactly the pool free poison pattern (0xdeadbeefdeadbeef;
mtx_enter's argument is that plus 0xe0), which the kernel writes
into freed items, so this is not a random memory error.
>How-To-Repeat:
A daemon whose root parent fork+execs two privilege-separated
children per accepted TCP/TLS connection and reaps them on SIGCHLD.
Five concurrent clients make about 1500 connections in about 40 s;
in the last phase each client closes before the server replies.
Two panics in about seven runs, both during this workload.
Process accounting was on for the second, off for the first.
>Fix:
Unknown.
dmesg:
OpenBSD 8.0 (GENERIC.MP) #84: Tue Oct 6 23:13:49 MDT 2026
[email protected]:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 8441147392 (8050MB)
avail mem = 8162750464 (7784MB)
random: good seed from bootblocks
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 3.0 @ 0xedab0 (49 entries)
bios0: vendor American Megatrends Inc. version "5.6.5" date 07/22/2022
bios0: Default string RC100/BC100
efi0 at bios0: UEFI 2.4
efi0: American Megatrends rev 0x5000a
acpi0 at bios0: ACPI 5.0
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP APIC FPDT FIDT TCPA LPIT MCFG HPET SSDT SSDT SSDT UEFI
SSDT TPM2 CSRT
acpi0: wakeup devices PS2K(S3) PS2M(S3) XHC1(S4) RP01(S4) PXSX(S4) RP02(S4)
PXSX(S4) RP03(S4) PXSX(S4) RP04(S4) PXSX(S4) PWRB(S0) BRCM(S0)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Celeron(R) CPU J1900 @ 1.99GHz, 2000.29 MHz, 06-37-09, patch
0000090d
cpu0: cpuid 1
edx=bfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
ecx=41d8e3bf<SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,DEADLINE,RDRAND>
cpu0: cpuid 6 eax=7<SENSOR,ARAT> ecx=9<EFFFREQ>
cpu0: cpuid 7.0 ebx=2282<TSC_ADJUST,SMEP,ERMS>
edx=c000400<MD_CLEAR,IBRS,IBPB,STIBP>
cpu0: cpuid a vers=3, gp=2, gpwidth=40, ff=3, ffwidth=40
cpu0: cpuid 80000001 edx=28100800<NXE,RDTSCP,LONG> ecx=101<LAHF,3DNOWP>
cpu0: cpuid 80000007 edx=100<ITSC>
cpu0: MELTDOWN
cpu0: 24KB 64b/line 6-way D-cache, 32KB 64b/line 8-way I-cache, 1MB 64b/line
16-way L2 cache
cpu0: smt 0, core 0, package 0, type P
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 83MHz
cpu0: mwait min=64, max=64, C-substates=0.2.0.0.0.0.3.3, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: Intel(R) Celeron(R) CPU J1900 @ 1.99GHz, 2000.47 MHz, 06-37-09, patch
0000090d
cpu1: smt 0, core 1, package 0, type P
cpu2 at mainbus0: apid 4 (application processor)
cpu2: Intel(R) Celeron(R) CPU J1900 @ 1.99GHz, 2000.62 MHz, 06-37-09, patch
0000090d
cpu2: smt 0, core 2, package 0, type P
cpu3 at mainbus0: apid 6 (application processor)
cpu3: Intel(R) Celeron(R) CPU J1900 @ 1.99GHz, 2000.60 MHz, 06-37-09, patch
0000090d
cpu3: smt 0, core 3, package 0, type P
ioapic0 at mainbus0: apid 1 pa 0xfec00000, version 20, 87 pins
acpimcfg0 at acpi0
acpimcfg0: addr 0xe0000000, bus 0-255
acpihpet0 at acpi0: 14318179 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 1 (RP01)
acpiprt2 at acpi0: bus 2 (RP02)
acpiprt3 at acpi0: bus 3 (RP03)
acpiprt4 at acpi0: bus 4 (RP04)
acpiec0 at acpi0: not present
acpicmos0 at acpi0
acpipci0 at acpi0 PCI0: 0x00000010 0x00000011 0x00000000
"MSFT0001" at acpi0 not configured
"MSFT0003" at acpi0 not configured
com0 at acpi0 UAR1 addr 0x3f8/0x8 irq 4: ns16550a, 16 byte fifo
com0: probed fifo depth: 15 bytes
com1 at acpi0 UAR2 addr 0x2f8/0x8 irq 3: ns16550a, 16 byte fifo
com1: probed fifo depth: 15 bytes
acpibtn0 at acpi0: PWRB(wakeup)
acpibtn1 at acpi0: SLPB
bytgpio0 at acpi0 GPO0 uid 1 addr 0xfed0c000/0x1000 irq 49, 102 pins
bytgpio1 at acpi0 GPO1 uid 2 addr 0xfed0d000/0x1000 irq 48, 28 pins
bytgpio2 at acpi0 GPO2 uid 3 addr 0xfed0e000/0x1000 irq 50, 44 pins
"INTL9C60" at acpi0 not configured
iosf0 at acpi0 MBID
tpm0 at acpi0 TPM_: unsupported TPM2 start method 2
acpicpu0 at acpi0: C3(10@1500 mwait.1@0x52), C2(10@500 mwait.1@0x51), C1(1000@1
mwait.1), PSS
acpicpu1 at acpi0: C3(10@1500 mwait.1@0x52), C2(10@500 mwait.1@0x51), C1(1000@1
mwait.1), PSS
acpicpu2 at acpi0: C3(10@1500 mwait.1@0x52), C2(10@500 mwait.1@0x51), C1(1000@1
mwait.1), PSS
acpicpu3 at acpi0: C3(10@1500 mwait.1@0x52), C2(10@500 mwait.1@0x51), C1(1000@1
mwait.1), PSS
acpipwrres0 at acpi0: PLPE
acpipwrres1 at acpi0: PLPE
acpipwrres2 at acpi0: USBC, resource for EHC1, OTG1
acpipwrres3 at acpi0: CLK0, resource for CAM1
acpipwrres4 at acpi0: CLK1, resource for CAM0, CAM2
acpivideo0 at acpi0: GFX0
acpivout0 at acpivideo0: DD1F
cpu0: using VERW MDS workaround
cpu0: Enhanced SpeedStep 2000 MHz: speeds: 1993, 1992, 1909, 1826, 1743, 1660,
1577, 1494, 1411, 1328 MHz
pci0 at mainbus0 bus 0
iosf1 at pci0 dev 0 function 0 "Intel Bay Trail Host" rev 0x11: mbi
inteldrm0 at pci0 dev 2 function 0 "Intel Bay Trail Video" rev 0x11
drm0 at inteldrm0
inteldrm0: msi, VALLEYVIEW, gen 7
sdhc0 at pci0 dev 18 function 0 "Intel Bay Trail SD/MMC" rev 0x11: apic 1 int 18
sdhc0: SDHC 3.00, 100 MHz base clock
sdmmc0 at sdhc0: 4-bit, sd high-speed, mmc high-speed, ddr52, dma
ahci0 at pci0 dev 19 function 0 "Intel Bay Trail AHCI" rev 0x11: msi, AHCI 1.3
ahci0: port 0: 3.0Gb/s
scsibus1 at ahci0: 32 targets
sd0 at scsibus1 targ 0 lun 0: <ATA, TS128GMSA230S, R042> naa.57c35481d355e8ca
sd0: 122104MB, 512 bytes/sector, 250069680 sectors, thin
xhci0 at pci0 dev 20 function 0 "Intel Bay Trail xHCI" rev 0x11: msi, xHCI 1.0
usb0 at xhci0: USB revision 3.0
uhub0 at usb0 configuration 1 interface 0 "Intel xHCI root hub" rev 3.00/1.00
addr 1
"Intel Bay Trail TXE" rev 0x11 at pci0 dev 26 function 0 not configured
azalia0 at pci0 dev 27 function 0 "Intel Bay Trail HD Audio" rev 0x11: msi
azalia0: codecs: Realtek ALC888, Intel/0x2882, using Realtek ALC888
audio0 at azalia0
ppb0 at pci0 dev 28 function 0 "Intel Bay Trail PCIE" rev 0x11: msi
pci1 at ppb0 bus 1
em0 at pci1 dev 0 function 0 "Intel I210" rev 0x03: msi, address
ac:40:ea:03:5a:46
ppb1 at pci0 dev 28 function 1 "Intel Bay Trail PCIE" rev 0x11: msi
pci2 at ppb1 bus 2
em1 at pci2 dev 0 function 0 "Intel I210" rev 0x03: msi, address
ac:40:ea:03:5a:47
ppb2 at pci0 dev 28 function 2 "Intel Bay Trail PCIE" rev 0x11: msi
pci3 at ppb2 bus 3
ppb3 at pci0 dev 28 function 3 "Intel Bay Trail PCIE" rev 0x11: msi
pci4 at ppb3 bus 4
pcib0 at pci0 dev 31 function 0 "Intel Bay Trail LPC" rev 0x11
ichiic0 at pci0 dev 31 function 3 "Intel Bay Trail SMBus" rev 0x11: apic 1 int
18
iic0 at ichiic0
spdmem0 at iic0 addr 0x50: 8GB DDR3 SDRAM PC3-12800 SO-DIMM
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5 irq 1 irq 12
pckbd0 at pckbc0 (kbd slot)
wskbd0 at pckbd0: console keyboard
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
vmm0 at mainbus0: VMX/EPT (using slow L1TF mitigation)
efifb at mainbus0 not configured
enable mbufs in high memory
sdmmc0: can't enable card
uhub1 at uhub0 port 4 configuration 1 interface 0 "Standard Microsystems
product 0x2514" rev 2.00/b.b3 addr 2
uhub1: port 3, set config 0 at addr 3 failed
uhub1: device problem, disabling port 3
vscsi0 at root
scsibus2 at vscsi0: 256 targets
softraid0 at root
scsibus3 at softraid0: 256 targets
root on sd0a (3a5cea56faa34e64.a) swap on sd0b dump on sd0b
WARNING: / was not properly unmounted
inteldrm0: 2560x1440, 32bpp
wsdisplay0 at inteldrm0 mux 1: console (std, vt100 emulation), using wskbd0
wsdisplay0: screen 1-5 added (std, vt100 emulation)
