syzbot


uvm_fault: ffs2_balloc (7)

Status: upstream: reported on 2026/03/27 02:05
Reported-by: syzbot+27c62742ccfde7447505@syzkaller.appspotmail.com
First crash: 59d, last: 1h05m
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) -1 3 1161d 1231d 0/3 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc (5) -1 4 407d 554d 0/3 auto-obsoleted due to no activity on 2025/07/12 07:43
openbsd uvm_fault: ffs2_balloc (6) -1 10 166d 254d 0/3 auto-obsoleted due to no activity on 2026/03/09 12:43
openbsd uvm_fault: ffs2_balloc -1 1 1530d 1530d 0/3 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) -1 5 752d 856d 0/3 auto-obsoleted due to no activity on 2024/07/31 16:15
openbsd uvm_fault: ffs2_balloc (4) -1 17 617d 628d 0/3 auto-obsoleted due to no activity on 2024/11/04 07:48

Sample crash report:
uvm_fault(0xffffffff83aba540, 0xffff8000276f2e48, 0, 2) -> d
kernel: page fault trap, code=2
Stopped at      ffs2_balloc+0x1864:     movq    %r15,0(%rax,%rbx,8)
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*100678  60229      0      0x2000  0x4080000    0K syz-executor
 160083  81230      0  0x10000002        0x1    1  syz-executor
ffs2_balloc(fffffd806cd42020,754000,4000,fffffd80097fd548,2,ffff80002a2447a8) at ffs2_balloc+0x1864 sys/ufs/ffs/ffs_balloc.c:691
ffs_write(ffff80002a244830) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd80607b7b30,ffff80002a2449e8,7,fffffd80097fd548) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806f31bbe8,ffff80002a2449e8,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000fffeed10,7,ffff80002a2449e8,0,ffff80002a244aa0) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff8000fffeed10,ffff80002a244b50,ffff80002a244aa0) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80002a244b50) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a244b50) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa8144fc1460, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffffff83aba540, 0xffff8000276f2e48, 0, 2) -> d
ddb{0}> trace
ffs2_balloc(fffffd806cd42020,754000,4000,fffffd80097fd548,2,ffff80002a2447a8) at ffs2_balloc+0x1864 sys/ufs/ffs/ffs_balloc.c:691
ffs_write(ffff80002a244830) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd80607b7b30,ffff80002a2449e8,7,fffffd80097fd548) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806f31bbe8,ffff80002a2449e8,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000fffeed10,7,ffff80002a2449e8,0,ffff80002a244aa0) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff8000fffeed10,ffff80002a244b50,ffff80002a244aa0) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80002a244b50) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a244b50) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xa8144fc1460, count: -8
ddb{0}> show registers
rdi                                0
rsi                          0x80000    acpi_pdirpa+0x6be71
rbp               0xffff80002a244750
rbx                            0x1c9
rdx               0xffff800001625480
rcx               0xffff8000fffeed10
rax               0xffff8000276f2000
r8                          0x100000    acpi_pdirpa+0xebe71
r9                                 0
r10               0x366580f7dcef5b6b
r11               0xd1315103209e6902
r12                              0x2
r13               0xfffffd806cd42020
r14               0xfffffd805e28a000
r15                          0x3d218    acpi_pdirpa+0x29089
rip               0xffffffff8193d4e4    ffs2_balloc+0x1864
cs                               0x8
rflags                       0x10202    __ALIGN_SIZE+0xf202
rsp               0xffff80002a2445d0
ss                              0x10
ffs2_balloc+0x1864:     movq    %r15,0(%rax,%rbx,8)
ddb{0}> show proc
PROC (syz-executor) tid=100678 pid=60229 tcnt=3 stat=onproc
    flags process=2000<SINGLEUNWIND> proc=4080000<SUSPSINGLE,THREAD>
    runpri=83, usrpri=83, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff8000fffefca0 scnt=1 ecnt=0
    forw=0xffffffffffffffff, list=0xffff8000fffefca0,0xffff80003c40d798
    process=0xffff80003c4721d8 user=0xffff80002a23f000, vmspace=0xfffffd806e860998
    estcpu=33, cpticks=17, pctcpu=0.6, user=0, sys=17, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 35180  374627  47895      0  2           0                syz-executor
 35180  108010  47895      0  3   0x4000080  fsleep        syz-executor
 84038  276674  28580      0  2           0                syz-executor
 84038  134239  28580      0  3   0x4000080  fsleep        syz-executor
 93314   39566  19815      0  3           0  vmmaplk       syz-executor
 93314  343074  19815      0  3   0x4000080  fsleep        syz-executor
 93314  356641  19815      0  2   0x4000000                syz-executor
 55675  469948    554      0  2           0                syz-executor
 55675  257899    554      0  3   0x4000080  fsleep        syz-executor
 46793  464085  72933      0  3        0x80  nanoslp       syz-executor
 46793  163814  72933      0  3   0x4000080  kqpoll        syz-executor
 46793  232617  72933      0  3   0x4000080  fsleep        syz-executor
 85466  357864  86910  60929  3        0x90  nanoslp       syz-executor
 85466  443971  86910  60929  3   0x4000090  netcon        syz-executor
 85466   14566  86910  60929  3   0x4000090  fsleep        syz-executor
 85466  441709  86910  60929  3   0x4000090  fsleep        syz-executor
 60229  363315  71239      0  3      0x2000  suspend       syz-executor
*60229  100678  71239      0  7   0x4082000                syz-executor
 60229  393630  71239      0  4   0x4082000                syz-executor
 54479   95842      1      0  3    0x100083  ttyin         getty
 71239  470307  16895      0  3        0x82  nanoslp       syz-executor
 42990  132041      0      0  3     0x14200  acct          acct
  2241  271441      0      0  3     0x14280  nfsidl

Crashes (312):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/25 09:52 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/25 07:44 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/25 04:15 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/25 00:05 openbsd 6adc68a286a5 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/23 17:48 openbsd 19a8be4fa5c4 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/23 07:38 openbsd dbd5cf8c5e8a c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/22 20:33 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/22 16:23 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/22 14:46 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/22 06:03 openbsd ca78e759411d 70ae9b03 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/22 04:56 openbsd ca78e759411d 70ae9b03 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/21 23:55 openbsd ca78e759411d 70ae9b03 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/21 14:50 openbsd 19a7e1efad25 747d777d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/21 05:41 openbsd be9eb1babb0f 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/21 01:42 openbsd be9eb1babb0f 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/20 19:26 openbsd d39f547900e2 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/20 12:02 openbsd d39f547900e2 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/19 18:54 openbsd 3fe334830a75 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/19 16:24 openbsd 8a5afb5cdcf9 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/19 14:39 openbsd 8a5afb5cdcf9 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/19 11:55 openbsd 8a5afb5cdcf9 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/18 14:39 openbsd 453e3248fd2d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/18 11:19 openbsd 453e3248fd2d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/18 03:08 openbsd 453e3248fd2d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/17 19:54 openbsd c52d99c0253a 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/17 17:39 openbsd c52d99c0253a 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/17 07:53 openbsd c057dfdb27e5 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/16 12:58 openbsd 501fc77f080e 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/15 23:41 openbsd 25d4b1a85733 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/15 16:18 openbsd 8e47d2e8b1e5 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/15 15:07 openbsd 8e47d2e8b1e5 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/15 12:58 openbsd 8e47d2e8b1e5 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/15 04:12 openbsd 9f6962b18ef0 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/14 08:52 openbsd 86898828a45d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 23:37 openbsd ed5454cb43ec 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 22:27 openbsd ed5454cb43ec 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 18:20 openbsd ed5454cb43ec 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 14:18 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 12:55 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 09:58 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 08:56 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 07:37 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 06:14 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/13 05:13 openbsd 104c674285fe 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 02:05 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.