syzbot


uvm_fault: ffs2_balloc (4)

Status: upstream: reported on 2024/09/03 23:54
Reported-by: syzbot+0bb8826e60568f7453d3@syzkaller.appspotmail.com
First crash: 12d, last: 1d11h
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) 3 545d 615d 0/3 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc 1 914d 914d 0/3 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) 5 137d 240d 0/3 auto-obsoleted due to no activity on 2024/07/31 16:15

Sample crash report:
uvm_fault(0xffffffff8355a950, 0xffff800028c22118, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs2_balloc+0x9fe:      movq    0(%rcx,%rax,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 13450  97207      0         0x2        0x1    1K syz-executor
 167595  19578      0         0x2          0    0  syz-executor
ffs2_balloc(fffffd8071eb5000,bf8c0,50,fffffd807f7d36e8,1,ffff80002a118448) at ffs2_balloc+0x9fe sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a1184d0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd805a596520,ffff80002a118588,3,fffffd807f7d36e8) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff8000ffff3460,fffffd805a596520,fffffd807f7d36e8,ffff80002a118650,ffff80002a118630) at ktrwriteraw+0x1bc sys/kern/kern_ktrace.c:682
ktrsyscall(ffff8000ffff3460,67,8,ffff80002a1187e0) at ktrsyscall+0x31d sys/kern/kern_ktrace.c:182
syscall(ffff80002a1187e0) at syscall+0x2eb mi_syscall sys/sys/syscall_mi.h:157 [inline]
syscall(ffff80002a1187e0) at syscall+0x2eb sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x718727cbdeb0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xffffffff8355a950, 0xffff800028c22118, 0, 1) -> d
ddb{1}> trace
ffs2_balloc(fffffd8071eb5000,bf8c0,50,fffffd807f7d36e8,1,ffff80002a118448) at ffs2_balloc+0x9fe sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a1184d0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd805a596520,ffff80002a118588,3,fffffd807f7d36e8) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff8000ffff3460,fffffd805a596520,fffffd807f7d36e8,ffff80002a118650,ffff80002a118630) at ktrwriteraw+0x1bc sys/kern/kern_ktrace.c:682
ktrsyscall(ffff8000ffff3460,67,8,ffff80002a1187e0) at ktrsyscall+0x31d sys/kern/kern_ktrace.c:182
syscall(ffff80002a1187e0) at syscall+0x2eb mi_syscall sys/sys/syscall_mi.h:157 [inline]
syscall(ffff80002a1187e0) at syscall+0x2eb sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x718727cbdeb0, count: -7
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a1183f0
rbx                                0
rdx                                0
rcx               0xffff800028c22000
rax                             0x23
r8                0xffffffffffffffff
r9                0xffff80002a118448
r10               0x8ea8d80c9d78e74d
r11               0x1c7542234c0e8718
r12                             0x10
r13                              0x1
r14                       0xffffffff
r15               0xfffffd8073f1d230
rip               0xffffffff82af31ae    ffs2_balloc+0x9fe
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff80002a118280
ss                              0x10
ffs2_balloc+0x9fe:      movq    0(%rcx,%rax,8),%r14
ddb{1}> show proc
PROC (syz-executor) tid=13450 pid=97207 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=1<INKTR>
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000ffff22a8,0xffff8000ffff1c10
    process=0xffff80003732cda0 user=0xffff80002a113000, vmspace=0xfffffd8009302370
    estcpu=36, cpticks=1, pctcpu=0.4, user=0, sys=6, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 26421  355846  27837      0  2           0                syz-executor
 26421   72294  27837      0  2   0x4000000                syz-executor
 45809  383654  25283      0  2           0                syz-executor
 45809  140775  25283      0  2   0x4000000                syz-executor
 45809  359291  25283      0  2   0x4000000                syz-executor
 63546  412482  53179      0  2        0x10                syz-executor
 63546    5686  53179      0  3   0x4000090  fsleep        syz-executor
 63546     928  53179      0  2   0x4000010                syz-executor
 63546   27932  53179      0  3   0x4000090  fsleep        syz-executor
 98762  495567  85483      0  2           0                syz-executor
 98762  271130  85483      0  2   0x4000000                syz-executor
 98762  275461  85483      0  3   0x4000080  fsleep        syz-executor
 52707  233399  82116      0  2        0x10                syz-executor
 52707  430727  82116      0  2   0x4000010                syz-executor
 52707  354283  82116      0  3   0x4000090  fsleep        syz-executor
 55388  325832  19578      0  2           0                syz-executor
 55388  513080  19578      0  2   0x4000000                syz-executor
 55388  304973  19578      0  3   0x4000000  vmmaplk       syz-executor
 26141  333073  26471      0  2         0x3                syz-executor
*97207   13450  26471      0  7         0x3                syz-executor
 85483   54817  26471      0  2         0x3                syz-executor
 19578  167595  26471      0  7         0x2                syz-executor
 82116  165196  26471      0  2         0x3                syz-executor
 53179  161117  26471      0  3        0x82  nanoslp       syz-executor
 25283  429336  26471      0  2         0x3                syz-executor
 27837  383446  26471      0  2         0x3                syz-executor
 69069  257989      0      0  3     0x14280  nfsidl        nfsio
 81655   93405      0      0  3     0x14280  nfsidl        nfsio
 22559  113976      0      0  3     0x14280  nfsidl        nfsio
  8573  413914      0      0  3     0x14280  nfsidl        nfsio
 16900  268781      0      0  3     0x14280  nfsidl        nfsio
 59635  278333      0      0  3     0x14280  nfsidl        nfsio
 53614  475465      0      0  3     0x14280  nfsidl        nfsio
 98738  264907      0      0  3     0x14280  nfsidl        nfsio
 51133  348495      0      0  3     0x14280  nfsidl        nfsio
 93515  237709      0      0  3     0x14280  nfsidl        nfsio
 42816  460801      0      0  3     0x14280  nfsidl        nfsio
 99378  230516      0      0  3     0x14280  nfsidl        nfsio
 49981  212619      0      0  3     0x14280  nfsidl        nfsio
 22917  316214      0      0  3     0x14280  nfsidl        nfsio
 41291  362318      0      0  3     0x14280  nfsidl        nfsio
 57884   99922      0      0  3     0x14280  nfsidl        nfsio
 84497  102320      0      0  3     0x14280  nfsidl        nfsio
 86958  414908      0      0  3     0x14280  nfsidl        nfsio
 77694  243668      0      0  3     0x14280  nfsidl        nfsio
 97416  396059      0      0  3     0x14280  nfsidl        nfsio
 75385  309608      0      0  3     0x14200  bored         sosplice
 26471  465136  99803      0  3        0x82  kqread        syz-executor
 99803  290191  11625      0  3    0x10008a  sigsusp       ksh
 11625  164657  47464      0  3        0x98  kqread        sshd-session
 47464   30413  25367      0  3        0x92  kqread        sshd-session
 87594  457508      1      0  3    0x100083  ttyopn        getty
 25367  218690      1      0  3        0x88  kqread        sshd
 14308   41075  17294     74  3   0x1100092  bpf           pflogd
 17294   12433      1      0  3        0x80  sbwait        pflogd
  6241  222760  34055     73  2   0x1100011                syslogd
 34055  268196      1      0  3    0x100082  sbwait        syslogd
 74692  152406      1      0  3    0x100080  kqread        resolvd
  3991  180201  89066     77  3    0x100092  kqread        dhcpleased
  3642   37872  89066     77  3    0x100092  kqread        dhcpleased
 89066   82424      1      0  3        0x80  kqread        dhcpleased
 85720   36583      0      0  3     0x14200  bored         smr
 36443  276515      0      0  3     0x14200  pgzero        zerothread
 19942  274640      0      0  3     0x14200  aiodoned      aiodoned
 42423  315423      0      0  3     0x14200  syncer        update
 34562  338604      0      0  3     0x14200  cleaner       cleaner
 25670  236958      0      0  3     0x14200  reaper        reaper
 97404  107863      0      0  3     0x14200  pgdaemon      pagedaemon
 76103   28292      0      0  3     0x14200  bored         viomb
 58006  269677      0      0  3  0x40014200  acpi0         acpi0
 56393  410695      0      0  3  0x40014200                idle1
 62468  150284      0      0  3     0x14200  bored         softnet3
 52074  331401      0      0  3     0x14200  bored         softnet2
 96344  476509      0      0  3     0x14200  bored         softnet1
 71943  101152      0      0  3     0x14200  bored         softnet0
 75097  183256      0      0  3     0x14200  bored         systqmp
 41573  465622      0      0  3     0x14200  bored         systq
 97796  399850      0      0  3     0x14200  tmoslp        softclockmp
 18411  237207      0      0  3  0x40014200  tmoslp        softclock
 16888  469550      0      0  3  0x40014200                idle0
     1  486573      0      0  3     0x80082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb{1}> show all locks
Process 45809 (syz-executor) thread 0xffff8000ffff0cd0 (359291)
exclusive rrwlock inode r = 0 (0xfffffd80679672c8)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  cache_lookup+0x36e sys/kern/vfs_cache.c:222
#7  ufs_lookup+0x218 sys/ufs/ufs/ufs_lookup.c:160
#8  VOP_LOOKUP+0x6e sys/kern/vfs_vops.c:85
#9  vfs_lookup+0x8fa sys/kern/vfs_lookup.c:566
#10 namei+0x7aa sys/kern/vfs_lookup.c:250
#11 ptmioctl+0x4cb sys/kern/tty_pty.c:1143
#12 VOP_IOCTL+0xac sys/kern/vfs_vops.c:264
#13 vn_ioctl+0xf6 sys/kern/vfs_vnops.c:525
#14 sys_ioctl+0x67c
#15 syscall+0xbb6 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#15 syscall+0xbb6 sys/arch/amd64/amd64/trap.c:577
#16 Xsyscall+0x128
Process 55388 (syz-executor) thread 0xffff8000ffff3970 (513080)
exclusive rwlock vmmaplk r = 0 (0xfffffd806bf35b40)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  vm_map_lock_ln+0x143 sys/uvm/uvm_map.c:5252
#3  uvm_map_pageable_all+0x69 sys/uvm/uvm_map.c:2329
#4  sys_mlockall+0x85 sys/uvm/uvm_mmap.c:898
#5  syscall+0xaf8 mi_syscall sys/sys/syscall_mi.h:179 [inline]
#5  syscall+0xaf8 sys/arch/amd64/amd64/trap.c:577
#6  Xsyscall+0x128
Process 97207 (syz-executor) thread 0xffff8000ffff3460 (13450)
exclusive rrwlock inode r = 0 (0xfffffd8071eb5098)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  rw_enter+0x41b sys/kern/kern_rwlock.c:309
#2  rrw_enter+0xbe sys/kern/kern_rwlock.c:464
#3  VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:564
#5  vget+0x2bd sys/kern/vfs_subr.c:676
#6  ktrwriteraw+0x172 sys/kern/kern_ktrace.c:679
#7  ktrsyscall+0x31d sys/kern/kern_ktrace.c:182
#8  syscall+0x2eb mi_syscall sys/sys/syscall_mi.h:157 [inline]
#8  syscall+0x2eb sys/arch/amd64/amd64/trap.c:577
#9  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83513ac8)
#0  witness_lock+0x5b8 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5b8 sys/kern/subr_witness.c:1151
#1  __mp_acquire_count+0x58
#2  mi_switch+0x658 sys/kern/sched_bsd.c:460
#3  yield+0x6a sys/kern/sched_bsd.c:320
#4  malloc+0xe5 sys/kern/kern_malloc.c:170
#5  ktrsyscall+0x17f sys/kern/kern_ktrace.c:174
#6  syscall+0x2eb mi_syscall sys/sys/syscall_mi.h:157 [inline]
#6  syscall+0x2eb sys/arch/amd64/amd64/trap.c:577
#7  Xsyscall+0x128
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10229  10117K   10502K 166960K     12123        0
            pcb    17     14K      16K 166960K       228        0
         rtable   217      7K       8K 166960K       919        0
             pf    41     18K      26K 166960K       113        0
         ifaddr    43      7K       7K 166960K       124        0
        ifgroup    64      2K       2K 166960K       146        0
         sysctl     3      0K       0K 166960K         3        0
       counters    68     36K      37K 166960K       112        0
       ioctlops     0      0K       4K 166960K      1533        0
            iov     0      0K      12K 166960K       135        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1433     90K      90K 166960K      2181        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         8        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        25        0
        dirhash    12      2K       2K 166960K        27        0
           ACPI  1690    195K     286K 166960K     12418        0
      file desc    17     61K      93K 166960K       966        0
          sigio     0      0K       0K 166960K        10        0
           proc    72     91K     152K 166960K      1022        0
        subproc   104      6K       6K 166960K       312        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        70        0
       in_multi    92      7K       7K 166960K       301        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     0      0K       0K 166960K         2        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   217    970K     970K 166960K       217        0
           exec     0      0K       1K 166960K       675        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   250     75K      92K 166960K      9889        0
       UVM aobj    14      2K       2K 166960K        15        0
     pinsyscall    42     84K     102K 166960K      2471        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        96        0
            NDP    14      0K       1K 166960K        86        0
           temp    58   6820K    6886K 166960K     38901        0
         kqueue    13     20K      28K 166960K       106        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       24    0        0     1     0     1     1     0     8    0
rtpcb      120      107    0      104     1     0     1     1     0     8    0
rtentry    112      310    0      212     4     0     4     4     0     8    0
unpcb      144      555    0      533     5     4     1     4     0     8    0
syncache   336       10    0       10     4     4     0     1     0     8    0
tcpqe       32        1   23        1     1     1     0     1     0     8    0
tcpcb      808      332    0      323    13     8     5     8     0     8    2
arp        120       53    0       35     1     0     1     1     0     8    0
inpcb      336     1183    0     1169    20    15     5     7     0     8    1
nd6        136       77    0       54     1     0     1     1     0     8    0
pkpcb       40        3    0        3     3     3     0     1     0     8    0
kcovpl      48       24    0       16     1     0     1     1     0     8    0
ppxss      1168       5    0        5     2     1     1     1     0     8    1
pffrag     232        3    0        1     1     0     1     1     0   482    0
pffrnode    88        3    0        1     1     0     1     1     0     8    0
pffrent     40        3    0        1     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1288       3    0        0     1     0     1     1     0     8    0
pftag       88        2    0        1     2     1     1     1     0     8    0
pfstitem    24       89    0       54     1     0     1     1     0     8    0
pfstkey    128       89    0       54     2     0     2     2     0     8    0
pfstate    376       89    0       54     5     0     5     5     0     8    0
pfrule     1344      28    0       20     2     0     2     2     0     8    0
art_heap8  4096       2    0        0     2     0     2     2     0     8    0
art_heap4  256     1218    0      804    30     0    30    30     0     8    2
art_table   32     1220    0      804     4     0     4     4     0     8    0
art_node    16      307    0      218     1     0     1     1     0     8    0
sysvmsgpl   40        7    0        3     2     1     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       20    0       10     1     0     1     1     0     8    0
shmpl      112       12    0        1     1     0     1     1     0     8    0
dirhash    1024      27    0       10     3     0     3     3     0     8    0
dino2pl    256     2779    0     1245    96     0    96    96     0     8    0
ffsino     272     2779    0     1245   103     0   103   103     0     8    0
nchpl      144     3849    0     2133    64     0    64    64     0     8    0
uvmvnodes   80     3397    0        0    70     0    70    70     0     8    0
vnodes     216     3397    0        0   189     0   189   189     0     8    0
namei      1024   14533    0    14532     7     5     2     3     0     8    1
percpumem   16       70    0       22     1     0     1     1     0     8    0
kstatmem   264       72    0       44     3     0     3     3     0     8    1
scsiplug    72        2    0        2     2     2     0     1     0     8    0
scxspl     216    19229    0    19229    10     9     1     8     1     8    1
plimitpl   152      227    0      207     1     0     1     1     0     8    0
sigapl     424     1257    0     1186    10     1     9     9     0     8    0
futexpl     64     9648    0     9644     3     2     1     1     0     8    0
knotepl    120      555    0        0    17     0    17    17     0     8    0
kqueuepl   216      230    0      220     5     4     1     5     0     8    0
pipepl     320      306    0      279     7     4     3     7     0     8    0
fdescpl    496     1218    0     1187     6     1     5     5     0     8    0
filepl     152     7119    0     6857    28    16    12    20     0     8    1
lockfpl    104      404    0      401     2     1     1     2     0     8    0
lockfspl    48      106    0      103     1     0     1     1     0     8    0
sessionpl  144       42    0       33     1     0     1     1     0     8    0
pgrppl      48       75    0       58     1     0     1     1     0     8    0
ucredpl    104     1254    0     1233     1     0     1     1     0     8    0
zombiepl   144     1467    0     1465     2     1     1     1     0     8    0
processpl  1160    1257    0     1186     7     1     6     6     0     8    0
procpl     648     2365    0     2282     9     1     8     9     0     8    1
srpgc       96        4    0        4     1     1     0     1     0     8    0
sosppl     168        6    0        5     4     3     1     1     0     8    0
sockpl     664     1856    0     1816    21    14     7     9     0     8    1
mcl64k     65536      4    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       4    0        0     1     0     1     1     0     8    0
mcl4k      4096       4    0        0     1     0     1     1     0     8    0
mcl2k      2048     222    0        0    28     0    28    28     0     8    0
mtagpl      96       23    0        0     1     0     1     1     0     8    0
mbufpl     256     4312    0        0   270     0   270   270     0     8    0
bufpl      280     6372    0      198   442     0   442   442     0     8    0
anonpl      24   232152    0   222289    70     9    61    61     0   185    1
amapchunkpl 152   32624    0    31763    48    12    36    36     0   158    2
amappl16   200     5034    0     4988    29    23     6    16     0     8    1
amappl15   192       10    0       10     1     1     0     1     0     8    0
amappl14   184      151    0      139     1     0     1     1     0     8    0
amappl13   176        7    0        7     1     1     0     1     0     8    0
amappl12   168     2125    0     2094     3     1     2     2     0     8    0
amappl11   160       51    0       37     1     0     1     1     0     8    0
amappl10   152        9    0        9     1     1     0     1     0     8    0
amappl9    144      140    0      140     1     1     0     1     0     8    0
amappl8    136       23    0       20     1     0     1     1     0     8    0
amappl7    128      137    0      125     1     0     1     1     0     8    0
amappl6    120      324    0      321     1     0     1     1     0     8    0
amappl5    112      202    0      191     1     0     1     1     0     8    0
amappl4    104      368    0      349     1     0     1     1     0     8    0
amappl3     96     6458    0     6338     5     1     4     5     0     8    0
amappl2     88      935    0      868     2     0     2     2     0     8    0
amappl1     80    11879    0    11308    14     0    14    14     0     8    0
amappl      88     9333    0     9145     5     0     5     5     0    92    0
dma16384   16384      1    0        1     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       20    0       19     1     0     1     1     0     8    0
aobjpl      72       14    0        1     1     0     1     1     0     8    0
uaddrrnd    24     1218    0     1187     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1218    0     1187     1     0     1     1     0     8    0
vmmpekpl   168    12092    0    12042     3     0     3     3     0     8    0
vmmpepl    168    82478    0    80590   106    13    93    99     0   357    7
vmsppl     440     1217    0     1187     6     2     4     5     0     8    0
rwobjpl     56    29741    0    25361    62     0    62    62     0     8    0
pdppl      4096    2443    0     2374   141    70    71    85     0     8    2
pvpl        32    29655    0        0   240     1   239   239     0   265    0
pmappl     248     1217    0     1187     3     0     3     3     0     8    0
extentpl    40       56    0       38     1     0     1     1     0     8    0
phpool     112      726    0      106    18     0    18    18     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff83464ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 sys/kern/kern_lock.c:144
softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 sys/kern/kern_lock.c:144
syscall(ffff800034186e10) at syscall+0x2cc mi_syscall sys/sys/syscall_mi.h:156 [inline]
syscall(ffff800034186e10) at syscall+0x2cc sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7461a293e1b0, count: 6
ddb{0}> trace
x86_ipi_db(ffffffff83464ff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:393
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 sys/kern/kern_lock.c:144
softintr_dispatch(0) at softintr_dispatch+0x5b sys/arch/amd64/amd64/softintr.c:88
Xsoftclock() at Xsoftclock+0x27
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:113 [inline]
__mp_lock(ffffffff835138c0) at __mp_lock+0x192 sys/kern/kern_lock.c:144
syscall(ffff800034186e10) at syscall+0x2cc mi_syscall sys/sys/syscall_mi.h:156 [inline]
syscall(ffff800034186e10) at syscall+0x2cc sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7461a293e1b0, count: -9
ddb{0}> machine ddbcpu 1
Stopped at      ffs2_balloc+0x9fe:      movq    0(%rcx,%rax,8),%r14
ffs2_balloc(fffffd8071eb5000,bf8c0,50,fffffd807f7d36e8,1,ffff80002a118448) at ffs2_balloc+0x9fe sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a1184d0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd805a596520,ffff80002a118588,3,fffffd807f7d36e8) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff8000ffff3460,fffffd805a596520,fffffd807f7d36e8,ffff80002a118650,ffff80002a118630) at ktrwriteraw+0x1bc sys/kern/kern_ktrace.c:682
ktrsyscall(ffff8000ffff3460,67,8,ffff80002a1187e0) at ktrsyscall+0x31d sys/kern/kern_ktrace.c:182
syscall(ffff80002a1187e0) at syscall+0x2eb mi_syscall sys/sys/syscall_mi.h:157 [inline]
syscall(ffff80002a1187e0) at syscall+0x2eb sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x718727cbdeb0, count: 8
ddb{1}> trace
ffs2_balloc(fffffd8071eb5000,bf8c0,50,fffffd807f7d36e8,1,ffff80002a118448) at ffs2_balloc+0x9fe sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a1184d0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd805a596520,ffff80002a118588,3,fffffd807f7d36e8) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff8000ffff3460,fffffd805a596520,fffffd807f7d36e8,ffff80002a118650,ffff80002a118630) at ktrwriteraw+0x1bc sys/kern/kern_ktrace.c:682
ktrsyscall(ffff8000ffff3460,67,8,ffff80002a1187e0) at ktrsyscall+0x31d sys/kern/kern_ktrace.c:182
syscall(ffff80002a1187e0) at syscall+0x2eb mi_syscall sys/sys/syscall_mi.h:157 [inline]
syscall(ffff80002a1187e0) at syscall+0x2eb sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x718727cbdeb0, count: -7

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/15 07:47 openbsd ceaa8a7a3bfc 08d8a733 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/15 03:12 openbsd ceaa8a7a3bfc 08d8a733 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/14 16:53 openbsd f4336680ed94 08d8a733 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/14 00:41 openbsd 3800fc3581d8 ff60e2ca .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 15:20 openbsd 17ca662f6c9e b58f933c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 13:53 openbsd 17ca662f6c9e b58f933c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 13:40 openbsd 17ca662f6c9e b58f933c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 13:39 openbsd 17ca662f6c9e b58f933c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 10:35 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 07:26 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 03:35 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 02:22 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 01:11 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 00:39 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/13 00:01 openbsd 00475b9b7a59 73e8a465 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/12 20:40 openbsd 8f60bb2f0860 60e1a995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2024/09/03 23:53 openbsd be4dcae9074d 9d47f20a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.