syzbot


uvm_fault: ffs2_balloc (7)

Status: upstream: reported on 2026/03/27 02:05
Reported-by: syzbot+27c62742ccfde7447505@syzkaller.appspotmail.com
First crash: 11d, last: 40m
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) -1 3 1113d 1183d 0/3 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc (5) -1 4 359d 506d 0/3 auto-obsoleted due to no activity on 2025/07/12 07:43
openbsd uvm_fault: ffs2_balloc (6) -1 10 118d 206d 0/3 auto-obsoleted due to no activity on 2026/03/09 12:43
openbsd uvm_fault: ffs2_balloc -1 1 1482d 1482d 0/3 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) -1 5 704d 808d 0/3 auto-obsoleted due to no activity on 2024/07/31 16:15
openbsd uvm_fault: ffs2_balloc (4) -1 17 569d 580d 0/3 auto-obsoleted due to no activity on 2024/11/04 07:48

Sample crash report:
uvm_fault(0xffffffff839971a8, 0xffff8000298b20f0, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs2_balloc+0xa0d:      movq    0(%rcx,%rax,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
  32763  12927      0           0          0    1  syz-executor
*209218  50318      0         0x2        0x1    0  syz-executor
ffs2_balloc(fffffd806dae9840,ab843,50,fffffd80097fd3a8,1,ffff80002a350298) at ffs2_balloc+0xa0d sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a350320) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd80606e47d8,ffff80002a3503d0,3,fffffd80097fd3a8) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a231240,fffffd80606e47d8,fffffd80097fd3a8,ffff80002a3504a0,ffff80002a350480) at ktrwriteraw+0x1be sys/kern/kern_ktrace.c:691
ktrsysret(ffff80002a231240,5b,0,ffff80002a350570) at ktrsysret+0x192 ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80002a231240,5b,0,ffff80002a350570) at ktrsysret+0x192 sys/kern/kern_ktrace.c:209
syscall(ffff80002a350620) at syscall+0xa51 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80002a350620) at syscall+0xa51 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6fc9b3ea5370, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffffff839971a8, 0xffff8000298b20f0, 0, 1) -> d
ddb{0}> trace
ffs2_balloc(fffffd806dae9840,ab843,50,fffffd80097fd3a8,1,ffff80002a350298) at ffs2_balloc+0xa0d sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a350320) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd80606e47d8,ffff80002a3503d0,3,fffffd80097fd3a8) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a231240,fffffd80606e47d8,fffffd80097fd3a8,ffff80002a3504a0,ffff80002a350480) at ktrwriteraw+0x1be sys/kern/kern_ktrace.c:691
ktrsysret(ffff80002a231240,5b,0,ffff80002a350570) at ktrsysret+0x192 ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80002a231240,5b,0,ffff80002a350570) at ktrsysret+0x192 sys/kern/kern_ktrace.c:209
syscall(ffff80002a350620) at syscall+0xa51 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80002a350620) at syscall+0xa51 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6fc9b3ea5370, count: -7
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a350240
rbx                                0
rdx                                0
rcx               0xffff8000298b2000
rax                             0x1e
r8                0xffffffffffffffff
r9                0xffff80002a350298
r10               0x51d67e20c1cc304d
r11               0xdca333c9dc582382
r12                              0x1
r13               0xffff800000c31800
r14               0xffff80002a3500d0
r15               0xfffffd8067696b10
rip               0xffffffff81f069dd    ffs2_balloc+0xa0d
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a3500c0
ss                              0x10
ffs2_balloc+0xa0d:      movq    0(%rcx,%rax,8),%r14
ddb{0}> 

Crashes (89):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/07 10:12 openbsd c0c2c6a525e1 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/06 22:59 openbsd fe321e1b70bc 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/06 07:15 openbsd 8a4a3a78bbe7 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/05 22:33 openbsd bc22b0de1984 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/05 20:49 openbsd bc22b0de1984 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/05 15:49 openbsd c9c58e023502 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/05 14:31 openbsd c9c58e023502 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/05 12:58 openbsd c9c58e023502 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/05 05:35 openbsd c9c58e023502 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/05 01:47 openbsd c9c58e023502 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/04 12:33 openbsd c9c58e023502 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/04 07:48 openbsd c9c58e023502 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/04 02:19 openbsd a0d451d3ebb4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/03 21:05 openbsd a0d451d3ebb4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/03 19:49 openbsd a0d451d3ebb4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/03 14:19 openbsd de6be2070bf6 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/03 05:46 openbsd de6be2070bf6 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/03 04:12 openbsd 38cd3ff5d287 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/03 02:37 openbsd 38cd3ff5d287 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/02 20:51 openbsd 38cd3ff5d287 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/02 14:38 openbsd 8eafb9a57fa3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/02 13:34 openbsd 8eafb9a57fa3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/02 08:44 openbsd 8eafb9a57fa3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/02 07:31 openbsd 8eafb9a57fa3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/02 04:10 openbsd 8eafb9a57fa3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/02 04:03 openbsd 8eafb9a57fa3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/01 23:41 openbsd ffc378411de4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/01 21:47 openbsd ffc378411de4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/01 20:32 openbsd ffc378411de4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/01 17:22 openbsd ffc378411de4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/01 16:14 openbsd ffc378411de4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/01 08:56 openbsd 9f2496a89535 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/01 03:40 openbsd 9f2496a89535 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/01 00:34 openbsd 9f2496a89535 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/31 20:42 openbsd 077f28b4c6a4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/31 19:17 openbsd 077f28b4c6a4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/31 15:54 openbsd 077f28b4c6a4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/31 12:19 openbsd 077f28b4c6a4 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/31 08:41 openbsd 0a71aa187b1b 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/31 04:15 openbsd 0a71aa187b1b 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/31 01:02 openbsd 0a71aa187b1b 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/31 00:19 openbsd 0a71aa187b1b 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/30 22:14 openbsd 0a71aa187b1b 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/30 09:24 openbsd d3e6ebe0e992 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/30 08:45 openbsd 7ab78e8bd090 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/30 02:04 openbsd 7ab78e8bd090 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/29 21:09 openbsd 7ab78e8bd090 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/29 17:17 openbsd 8c0bc7d7b019 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/29 17:08 openbsd 8c0bc7d7b019 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/29 16:26 openbsd 8c0bc7d7b019 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/29 15:06 openbsd 8c0bc7d7b019 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 17:59 openbsd f3ad7971a235 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 17:17 openbsd f3ad7971a235 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/27 13:53 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 05:30 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/27 04:30 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 04:13 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 03:16 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 02:05 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.