uvm_fault: ffs_freefile (3)

Status: upstream: reported on 2026/03/27 23:15
Reported-by: syzbot+0ed6c58abf4b6f542e62@syzkaller.appspotmail.com
First crash: 179d, last: 45d
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs_freefile (2) -1 1 374d 374d 0/4 auto-obsoleted due to no activity on 2025/12/12 07:10
openbsd uvm_fault: ffs_freefile -1 2 738d 740d 0/4 auto-obsoleted due to no activity on 2024/12/13 12:31

Sample crash report:
uvm_fault(0xffffffff839ff588, 0xffff800026ad2004, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs_freefile+0x11e:     movl    0x4(%rbx),%r13d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 95838  99061      0         0x2          0    0  syz-executor
ffs_freefile(fffff8006f561700,4ee,6000) at ffs_freefile+0x11e ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_freefile(fffff8006f561700,4ee,6000) at ffs_freefile+0x11e sys/ufs/ffs/ffs_alloc.c:1377
ffs_inode_free(fffff8006f561700,4ee,6000) at ffs_inode_free+0x44 sys/ufs/ffs/ffs_alloc.c:1355
ufs_inactive(ffff80002a82b910) at ufs_inactive+0x299 sys/ufs/ufs/ufs_inode.c:94
VOP_INACTIVE(fffff8006e2b5048,ffff80002a736a68) at VOP_INACTIVE+0xfb sys/kern/vfs_vops.c:498
vput(fffff8006e2b5048) at vput+0xdc sys/kern/vfs_subr.c:795
VOP_REMOVE(fffff80068439cb8,fffff8006e2b5048,ffff80002a82ba78) at VOP_REMOVE+0x199 sys/kern/vfs_vops.c:336
dounlinkat(ffff80002a736a68,ffffff9c,766455ff4450,0) at dounlinkat+0x1c4 sys/kern/vfs_syscalls.c:1843
syscall(ffff80002a82bbe0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a82bbe0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x766455ff4900, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839ff588, 0xffff800026ad2004, 0, 1) -> d
ddb> show kasan
No such command
ddb> 

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/08 04:54 openbsd d607cd596f17 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs_freefile
2026/06/24 04:11 openbsd 26c6eebc6662 042555ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs_freefile
2026/05/25 17:34 openbsd 61b7e18e5713 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs_freefile
2026/05/24 22:26 openbsd 6adc68a286a5 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs_freefile
2026/03/27 23:14 openbsd f3ad7971a235 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs_freefile
* Struck through repros no longer work on HEAD.