syzbot


uvm_fault: ffs2_balloc (5)

Status: upstream: reported on 2024/11/16 17:07
Reported-by: syzbot+0c2ce57e9a2687fac9b3@syzkaller.appspotmail.com
First crash: 5d02h, last: 5d02h
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) 3 611d 681d 0/3 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc 1 980d 980d 0/3 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) 5 203d 306d 0/3 auto-obsoleted due to no activity on 2024/07/31 16:15
openbsd uvm_fault: ffs2_balloc (4) 17 67d 78d 0/3 auto-obsoleted due to no activity on 2024/11/04 07:48

Sample crash report:
uvm_fault(0xffffffff835c7458, 0xffff800020002190, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs2_balloc+0x9ee:      movq    0(%rcx,%rax,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 32502  32819     73   0x1100010        0x1    0  syslogd
ffs2_balloc(fffffd806e0534c0,fa6e3,48,fffffd807f7d78f0,1,ffff80002a4dd4a8) at ffs2_balloc+0x9ee sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a4dd530) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd806c98ecd0,ffff80002a4dd5e0,3,fffffd807f7d78f0) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a4b1be8,fffffd806c98ecd0,fffffd807f7d78f0,ffff80002a4dd6a8,ffff80002a4dd680) at ktrwriteraw+0x191 sys/kern/kern_ktrace.c:682
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 ktrwrite2 sys/kern/kern_ktrace.c:644 [inline]
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 sys/kern/kern_ktrace.c:258
dofilewritev(ffff80002a4b1be8,e,ffff80002a4dd8a0,0,ffff80002a4dd960) at dofilewritev+0x4d3 sys/kern/sys_generic.c:398
sys_writev(ffff80002a4b1be8,ffff80002a4dda10,ffff80002a4dd960) at sys_writev+0xd8 sys/kern/sys_generic.c:327
syscall(ffff80002a4dda10) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x734adbd15e80, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff835c7458, 0xffff800020002190, 0, 1) -> d
ddb> trace
ffs2_balloc(fffffd806e0534c0,fa6e3,48,fffffd807f7d78f0,1,ffff80002a4dd4a8) at ffs2_balloc+0x9ee sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a4dd530) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd806c98ecd0,ffff80002a4dd5e0,3,fffffd807f7d78f0) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a4b1be8,fffffd806c98ecd0,fffffd807f7d78f0,ffff80002a4dd6a8,ffff80002a4dd680) at ktrwriteraw+0x191 sys/kern/kern_ktrace.c:682
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 ktrwrite2 sys/kern/kern_ktrace.c:644 [inline]
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 sys/kern/kern_ktrace.c:258
dofilewritev(ffff80002a4b1be8,e,ffff80002a4dd8a0,0,ffff80002a4dd960) at dofilewritev+0x4d3 sys/kern/sys_generic.c:398
sys_writev(ffff80002a4b1be8,ffff80002a4dda10,ffff80002a4dd960) at sys_writev+0xd8 sys/kern/sys_generic.c:327
syscall(ffff80002a4dda10) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x734adbd15e80, count: -9
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a4dd450
rbx               0xfffffd806e0534c0
rdx                                0
rcx               0xffff800020002000
rax                             0x32
r8                0xffffffffffffffff
r9                0xffff80002a4dd4a8
r10               0xd5d4689b12881254
r11               0x2e80afad441c20d4
r12                             0x10
r13                              0x1
r14                       0xffffffff
r15               0xfffffd8062ab8128
rip               0xffffffff81de831e    ffs2_balloc+0x9ee
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff80002a4dd2e0
ss                              0x10
ffs2_balloc+0x9ee:      movq    0(%rcx,%rax,8),%r14
ddb> show proc
PROC (syslogd) tid=32502 pid=32819 tcnt=1 stat=onproc
    flags process=1100010<SUGID,PLEDGE,CHROOT> proc=1<INKTR>
    runpri=17, usrpri=51, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a4b1960,0xffff80002a4b0a40
    process=0xffff8000ffff9578 user=0xffff80002a4d8000, vmspace=0xfffffd807e2d6588
    estcpu=1, cpticks=1, pctcpu=0.0, user=0, sys=3, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
  4219   52458      0      0  3     0x14200  acct          acct
  2021  486024  55361      0  3        0x82  piperd        syz-executor
 47103  126739  55361      0  3        0x82  piperd        syz-executor
 87565   43035      0      0  3     0x14200  bored         sosplice
 77492  222286  55361      0  3        0x82  piperd        syz-executor
 41328  411311  55361      0  3        0x82  piperd        syz-executor
 15993  129750  55361      0  3        0x82  piperd        syz-executor
 22089  311889  55361      0  3        0x82  piperd        syz-executor
 55361  468287   1451      0  3        0x82  wait          syz-executor
  1451  390775  63217      0  3    0x10008a  sigsusp       ksh
 63217  276562  80186      0  3        0x98  kqread        sshd-session
 80186  318140  68716      0  3        0x92  kqread        sshd-session
 29798   44675      1      0  3    0x100083  ttyin         getty
 68716  409299      1      0  3        0x88  kqread        sshd
*32819   32502   5175     73  7   0x1100011                syslogd
  5175  376814      1      0  3    0x100082  sbwait        syslogd
 39084  107438      1      0  3    0x100080  kqread        resolvd
 27340  469382  95886     77  3    0x100092  kqread        dhcpleased
 72709   97001  95886     77  3    0x100092  kqread        dhcpleased
 95886  303369      1      0  3        0x80  kqread        dhcpleased
 86755  268098      0      0  3     0x14200  bored         smr
 46902   65314      0      0  3     0x14200  pgzero        zerothread
 35871  266032      0      0  3     0x14200  aiodoned      aiodoned
 50171  208337      0      0  3     0x14200  syncer        update
  2647  353726      0      0  3     0x14200  cleaner       cleaner
 92992   27961      0      0  3     0x14200  reaper        reaper
 79904  198518      0      0  3     0x14200  pgdaemon      pagedaemon
 73092   91424      0      0  3     0x14200  bored         viomb
 14644  147386      0      0  3  0x40014200  acpi0         acpi0
 92624  295518      0      0  3     0x14200  bored         softnet3
 81605  145975      0      0  3     0x14200  bored         softnet2
 68279  275066      0      0  3     0x14200  bored         softnet1
 51969   18456      0      0  3     0x14200  bored         softnet0
 41071  341166      0      0  3     0x14200  bored         systqmp
 16085   86014      0      0  3     0x14200  bored         systq
 44187  137697      0      0  2  0x40014200                softclock
 18838  401305      0      0  3  0x40014200                idle0
     1  290864      0      0  3        0x82  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10179  11049K   11646K 166960K     12941        0
            pcb    17     15K      16K 166960K       298        0
         rtable   201      7K       8K 166960K       675        0
             pf    36     14K     270K 166960K       135        0
         ifaddr    40      7K       8K 166960K        71        0
        ifgroup    51      2K       2K 166960K        85        0
         sysctl     2      0K       0K 166960K         2        0
       counters    30     17K      17K 166960K        41        0
       ioctlops     0      0K       4K 166960K       226        0
            iov     0      0K      18K 166960K       131        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1456     91K      92K 166960K      2384        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        17        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        32        0
        dirhash    12      2K       2K 166960K        30        0
           ACPI  1690    195K     286K 166960K     12468        0
      file desc     9     29K      93K 166960K      1164        0
          sigio     0      0K       0K 166960K        65        0
           proc    60     59K      83K 166960K       646        0
        subproc    91      5K       6K 166960K       156        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       226        0
       in_multi    88      6K       7K 166960K       199        0
    ether_multi     1      0K       0K 166960K        23        0
            mrt     2      0K       0K 166960K        12        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys    85    387K     387K 166960K        85        0
           exec     0      0K       1K 166960K       493        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   150     62K      90K 166960K     11751        0
       UVM aobj    27      2K       2K 166960K        30        0
     pinsyscall    30     60K      96K 166960K      2280        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        56        0
            NDP    11      0K       2K 166960K        45        0
           temp    69   6817K    6887K 166960K     31790        0
         kqueue    13     20K      30K 166960K       203        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      117    0      114     1     0     1     1     0     8    0
rtentry    112      232    0      143     4     0     4     4     0     8    0
unpcb      144     1240    0     1225     6     0     6     6     0     8    5
syncache   336        7    0        7     1     0     1     1     0     8    1
tcpqe       32        1    0        1     1     0     1     1     0     8    1
tcpcb      808      328    0      323     4     0     4     4     0     8    3
arp         88       29    0       13     1     0     1     1     0     8    0
ipq         40        4    0        2     1     0     1     1     0     8    0
ipqe        40       94    0       91     1     0     1     1     0     8    0
inpcb      336     1480    0     1472    13     4     9    13     0     8    7
nd6        104       38    0       16     1     0     1     1     0     8    0
pkpcb       40        5    0        5     1     0     1     1     0     8    1
kcovpl      48       12    0        5     1     0     1     1     0     8    0
ppxss      1072       5    0        5     1     0     1     1     0     8    1
pfstscr     40        4    0        4     1     0     1     1     0     8    1
pfrktable  1344       1    0        0     1     0     1     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfstitem    24        4    0        2     1     0     1     1     0     8    0
pfstkey    128       19    0       15     1     0     1     1     0     8    0
pfstate    344       10    0        9     1     0     1     1     0     8    0
pfrule     1344       5    0        4     1     0     1     1     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      670    0      255    30     0    30    30     0     8    0
art_table   32      673    0      255     4     0     4     4     0     8    0
art_node    16      165    0       87     1     0     1     1     0     8    0
sysvmsgpl   40       14    0        6     1     0     1     1     0     8    0
semupl     112        1    0        1     1     0     1     1     0     8    1
semapl     112       27    0       17     1     0     1     1     0     8    0
shmpl      112       27    0        3     1     0     1     1     0     8    0
dirhash    1024      29    0       12     3     0     3     3     0     8    0
dino2pl    256     3346    0     1852    95     0    95    95     0     8    0
ffsino     240     3346    0     1852    89     0    89    89     0     8    0
nchpl      144     4986    0     3308    63     0    63    63     0     8    0
uvmvnodes   80     4141    0        0    85     0    85    85     0     8    0
vnodes     216     4141    0        0   231     0   231   231     0     8    0
namei      1024   18472    0    18472     2     0     2     2     0     8    2
kstatmem   264       44    0       22     2     0     2     2     0     8    0
scsiplug    72        6    0        6     1     0     1     1     0     8    1
scxspl     216    14636    0    14636     8     0     8     8     1     8    8
plimitpl   152      226    0      210     1     0     1     1     0     8    0
sigapl     424     1444    0     1404     6     0     6     6     0     8    0
futexpl     64    15778    0    15778     1     0     1     1     0     8    1
knotepl    120    54638    0    54591    21    11    10    16     0     8    8
kqueuepl   184      399    0      390     4     0     4     4     0     8    3
pipepl     288      201    0      174     4     0     4     4     0     8    1
fdescpl    432     1423    0     1402     5     0     5     5     0     8    1
filepl     120     9736    0     9520    15     0    15    15     0     8    7
lockfpl    104      358    0      356     1     0     1     1     0     8    0
lockfspl    48      119    0      117     1     0     1     1     0     8    0
sessionpl  144       28    0       20     1     0     1     1     0     8    0
pgrppl      48       46    0       30     1     0     1     1     0     8    0
ucredpl    104     1518    0     1506     1     0     1     1     0     8    0
zombiepl   144     1406    0     1404     1     0     1     1     0     8    0
processpl  1096    1444    0     1404     4     0     4     4     0     8    0
procpl     648     2819    0     2779     6     0     6     6     0     8    1
sosppl     168        4    0        4     1     0     1     1     0     8    1
sockpl     504     2857    0     2831    50    38    12    25     0     8    8
mcl64k     65536     21    0       21     1     0     1     1     0     8    1
mcl16k     16384     10    0       10     1     0     1     1     0     8    1
mcl12k     12288      1    0        1     1     0     1     1     0     8    1
mcl8k      8192      24    0       24     1     0     1     1     0     8    1
mcl4k      4096    4026    0     3975    19     4    15    19     0     8    7
mcl2k2     2112      25    0       25     1     0     1     1     0     8    1
mcl2k      2048    1275    0     1272     4     0     4     4     0     8    3
mtagpl      96       35    0       13     1     0     1     1     0     8    0
mbufpl     256    16019    0    15859    22     0    22    22     0     8    8
bufpl      280     6614    0      367   447     0   447   447     0     8    0
anonpl      24   234058    0   231389    97     0    97    97     0   187   66
amapchunkpl 152   40993    0    40734    50     0    50    50     0   158   31
amappl16   200     4379    0     4358    22    10    12    15     0     8    8
amappl15   192       10    0       10     1     0     1     1     0     8    1
amappl14   184      114    0      104     1     0     1     1     0     8    0
amappl13   176        6    0        6     1     0     1     1     0     8    1
amappl12   168     2086    0     2065     3     0     3     3     0     8    1
amappl11   160       49    0       38     1     0     1     1     0     8    0
amappl10   152        9    0        8     1     0     1     1     0     8    0
amappl9    144      102    0      102     1     0     1     1     0     8    1
amappl8    136       22    0       21     1     0     1     1     0     8    0
amappl7    128      105    0       94     1     0     1     1     0     8    0
amappl6    120      190    0      187     1     0     1     1     0     8    0
amappl5    112      143    0      134     1     0     1     1     0     8    0
amappl4    104      304    0      289     1     0     1     1     0     8    0
amappl3     96     7297    0     7246     3     0     3     3     0     8    0
amappl2     88     1732    0     1660     2     0     2     2     0     8    0
amappl1     80    11167    0    10681    13     0    13    13     0     8    1
amappl      88    11278    0    11181     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     0     1     1     0     8    1
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     0     1     1     0     8    1
dma128     128      256    0      256     1     0     1     1     0     8    1
dma64       64        7    0        7     1     0     1     1     0     8    1
dma32       32        7    0        7     1     0     1     1     0     8    1
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       29    0        3     1     0     1     1     0     8    0
uaddrrnd    24     1423    0     1402     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1423    0     1402     1     0     1     1     0     8    0
vmmpekpl   168    11356    0    11313     3     0     3     3     0     8    0
vmmpepl    168    91205    0    89893    89     0    89    89     0   357   11
vmsppl     352     1422    0     1402     4     0     4     4     0     8    1
rwobjpl     24    29364    0    24441    31     0    31    31     0     8    0
pdppl      4096    2852    0     2804   112    46    66    80     0     8   18
pvpl        32   627393    0   620692   281     0   281   281     0   265  190
pmappl     216     1422    0     1402     3     0     3     3     0     8    0
extentpl    40       55    0       38     1     0     1     1     0     8    0
phpool     112      457    0       92    11     0    11    11     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
ffs2_balloc(fffffd806e0534c0,fa6e3,48,fffffd807f7d78f0,1,ffff80002a4dd4a8) at ffs2_balloc+0x9ee sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a4dd530) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd806c98ecd0,ffff80002a4dd5e0,3,fffffd807f7d78f0) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a4b1be8,fffffd806c98ecd0,fffffd807f7d78f0,ffff80002a4dd6a8,ffff80002a4dd680) at ktrwriteraw+0x191 sys/kern/kern_ktrace.c:682
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 ktrwrite2 sys/kern/kern_ktrace.c:644 [inline]
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 sys/kern/kern_ktrace.c:258
dofilewritev(ffff80002a4b1be8,e,ffff80002a4dd8a0,0,ffff80002a4dd960) at dofilewritev+0x4d3 sys/kern/sys_generic.c:398
sys_writev(ffff80002a4b1be8,ffff80002a4dda10,ffff80002a4dd960) at sys_writev+0xd8 sys/kern/sys_generic.c:327
syscall(ffff80002a4dda10) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x734adbd15e80, count: -9
ddb> machine ddbcpu 1
No such command
ddb> trace
ffs2_balloc(fffffd806e0534c0,fa6e3,48,fffffd807f7d78f0,1,ffff80002a4dd4a8) at ffs2_balloc+0x9ee sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a4dd530) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd806c98ecd0,ffff80002a4dd5e0,3,fffffd807f7d78f0) at VOP_WRITE+0x102 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a4b1be8,fffffd806c98ecd0,fffffd807f7d78f0,ffff80002a4dd6a8,ffff80002a4dd680) at ktrwriteraw+0x191 sys/kern/kern_ktrace.c:682
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 ktrwrite2 sys/kern/kern_ktrace.c:644 [inline]
ktrgenio(ffff80002a4b1be8,e,1,ffff800000b66e80,68) at ktrgenio+0x2b6 sys/kern/kern_ktrace.c:258
dofilewritev(ffff80002a4b1be8,e,ffff80002a4dd8a0,0,ffff80002a4dd960) at dofilewritev+0x4d3 sys/kern/sys_generic.c:398
sys_writev(ffff80002a4b1be8,ffff80002a4dda10,ffff80002a4dd960) at sys_writev+0xd8 sys/kern/sys_generic.c:327
syscall(ffff80002a4dda10) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x734adbd15e80, count: -9

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/16 17:06 openbsd feb640d47767 cfe3a04a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.