syzbot


uvm_fault: ffs2_balloc (7)

Status: upstream: reported on 2026/03/27 02:05
Reported-by: syzbot+27c62742ccfde7447505@syzkaller.appspotmail.com
First crash: 73d, last: 31m
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) -1 3 1175d 1245d 0/3 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc (5) -1 4 421d 569d 0/3 auto-obsoleted due to no activity on 2025/07/12 07:43
openbsd uvm_fault: ffs2_balloc (6) -1 10 181d 268d 0/3 auto-obsoleted due to no activity on 2026/03/09 12:43
openbsd uvm_fault: ffs2_balloc -1 1 1544d 1544d 0/3 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) -1 5 767d 870d 0/3 auto-obsoleted due to no activity on 2024/07/31 16:15
openbsd uvm_fault: ffs2_balloc (4) -1 17 631d 642d 0/3 auto-obsoleted due to no activity on 2024/11/04 07:48

Sample crash report:
uvm_fault(0xffffffff83a66ec0, 0xffff8000261d2000, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs2_balloc+0xa0a:      movq    0(%rcx,%rax,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*323571  80222      0           0  0x4000000    0  syz-executor
ffs2_balloc(fffff2006a37d400,30001,40,fffff20007ffd7b8,1,ffff80002a79b338) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a79b3c0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffff20066d0c7c0,ffff80002a79b470,3,fffff20007ffd7b8) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a751cb0,fffff20066d0c7c0,fffff20007ffd7b8,ffff80002a79b528,0) at ktrwriteraw+0x19b sys/kern/kern_ktrace.c:692
doktrace(fffff20066d0c7c0,4,1b08,0,ffff80002a751cb0) at doktrace+0x88c ktrstart sys/kern/kern_ktrace.c:150 [inline]
doktrace(fffff20066d0c7c0,4,1b08,0,ffff80002a751cb0) at doktrace+0x88c sys/kern/kern_ktrace.c:485
sys_ktrace(ffff80002a751cb0,ffff80002a79b7f0,ffff80002a79b740) at sys_ktrace+0x11c sys/kern/kern_ktrace.c:559
syscall(ffff80002a79b7f0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a79b7f0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3c67fa374b0, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83a66ec0, 0xffff8000261d2000, 0, 1) -> d
ddb> trace
ffs2_balloc(fffff2006a37d400,30001,40,fffff20007ffd7b8,1,ffff80002a79b338) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a79b3c0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffff20066d0c7c0,ffff80002a79b470,3,fffff20007ffd7b8) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a751cb0,fffff20066d0c7c0,fffff20007ffd7b8,ffff80002a79b528,0) at ktrwriteraw+0x19b sys/kern/kern_ktrace.c:692
doktrace(fffff20066d0c7c0,4,1b08,0,ffff80002a751cb0) at doktrace+0x88c ktrstart sys/kern/kern_ktrace.c:150 [inline]
doktrace(fffff20066d0c7c0,4,1b08,0,ffff80002a751cb0) at doktrace+0x88c sys/kern/kern_ktrace.c:485
sys_ktrace(ffff80002a751cb0,ffff80002a79b7f0,ffff80002a79b740) at sys_ktrace+0x11c sys/kern/kern_ktrace.c:559
syscall(ffff80002a79b7f0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a79b7f0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3c67fa374b0, count: -8
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a79b2e0
rbx               0xfffff2006a37d400
rdx                                0
rcx               0xffff8000261d2000
rax                                0
r8                0xffffffffffffffff
r9                0xffff80002a79b338
r10               0x5bc51dfacd2baf7e
r11               0xd0a0e8b2e9655b0c
r12                              0x1
r13               0xffff800000c47800
r14               0xffff80002a79b180
r15               0xfffff2006f580240
rip               0xffffffff82b05e9a    ffs2_balloc+0xa0a
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a79b170
ss                              0x10
ffs2_balloc+0xa0a:      movq    0(%rcx,%rax,8),%r14
ddb> 

Crashes (335):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/08 18:04 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/07 14:21 openbsd 55e221da9e96 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/06 09:47 openbsd f12de7fa2924 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/02 11:48 openbsd 3e0a91e6cdcb cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/02 05:34 openbsd ce6468111c47 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/01 02:47 openbsd ca362689551c cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/31 09:52 openbsd b6d27d6c2ceb cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/31 04:43 openbsd 6568abc09117 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/30 15:33 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/30 08:32 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/30 05:25 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/29 20:46 openbsd 0120f5b67b1e cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/28 19:36 openbsd 56a24c520999 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/27 19:50 openbsd ed6146792872 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/27 05:42 openbsd 51e8ce08d8c9 2b01f00e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/27 04:18 openbsd 51e8ce08d8c9 2b01f00e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/26 13:43 openbsd d6937f154787 2b0043b4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/26 05:24 openbsd d6937f154787 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/26 03:40 openbsd 61b7e18e5713 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/26 00:14 openbsd 61b7e18e5713 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/25 20:58 openbsd 61b7e18e5713 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/25 13:05 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/25 09:52 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/25 07:44 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/25 04:15 openbsd 3ca1fbf96c86 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/25 00:05 openbsd 6adc68a286a5 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/23 17:48 openbsd 19a8be4fa5c4 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/23 07:38 openbsd dbd5cf8c5e8a c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/22 20:33 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/22 16:23 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/22 14:46 openbsd 54bbd1fe416a 95d90255 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/22 06:03 openbsd ca78e759411d 70ae9b03 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/22 04:56 openbsd ca78e759411d 70ae9b03 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/21 23:55 openbsd ca78e759411d 70ae9b03 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/21 14:50 openbsd 19a7e1efad25 747d777d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/21 05:41 openbsd be9eb1babb0f 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/21 01:42 openbsd be9eb1babb0f 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/20 19:26 openbsd d39f547900e2 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/20 12:02 openbsd d39f547900e2 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/19 18:54 openbsd 3fe334830a75 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/19 16:24 openbsd 8a5afb5cdcf9 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/19 14:39 openbsd 8a5afb5cdcf9 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/19 11:55 openbsd 8a5afb5cdcf9 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/18 14:39 openbsd 453e3248fd2d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/05/18 11:19 openbsd 453e3248fd2d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/18 03:08 openbsd 453e3248fd2d 340bcdf0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 02:05 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.