syzbot
uvm_fault: ffs_freefile (3)
Status:
upstream: reported on 2026/03/27 23:15
Reported-by: syzbot+0ed6c58abf4b6f542e62@syzkaller.appspotmail.com
First crash: 179d, last: 45d
Sample crash report:
uvm_fault(0xffffffff839ff588, 0xffff800026ad2004, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at ffs_freefile+0x11e: movl 0x4(%rbx),%r13d
TID PID UID PRFLAGS PFLAGS CPU COMMAND
* 95838 99061 0 0x2 0 0 syz-executor
ffs_freefile(fffff8006f561700,4ee,6000) at ffs_freefile+0x11e ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_freefile(fffff8006f561700,4ee,6000) at ffs_freefile+0x11e sys/ufs/ffs/ffs_alloc.c:1377
ffs_inode_free(fffff8006f561700,4ee,6000) at ffs_inode_free+0x44 sys/ufs/ffs/ffs_alloc.c:1355
ufs_inactive(ffff80002a82b910) at ufs_inactive+0x299 sys/ufs/ufs/ufs_inode.c:94
VOP_INACTIVE(fffff8006e2b5048,ffff80002a736a68) at VOP_INACTIVE+0xfb sys/kern/vfs_vops.c:498
vput(fffff8006e2b5048) at vput+0xdc sys/kern/vfs_subr.c:795
VOP_REMOVE(fffff80068439cb8,fffff8006e2b5048,ffff80002a82ba78) at VOP_REMOVE+0x199 sys/kern/vfs_vops.c:336
dounlinkat(ffff80002a736a68,ffffff9c,766455ff4450,0) at dounlinkat+0x1c4 sys/kern/vfs_syscalls.c:1843
syscall(ffff80002a82bbe0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a82bbe0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x766455ff4900, count: 6
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb>
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839ff588, 0xffff800026ad2004, 0, 1) -> d
ddb> show kasan
No such command
ddb>
* Struck through repros no longer work on HEAD.