uvm_fault: ffs2_balloc (7)

Status: upstream: reported on 2026/03/27 02:05
Reported-by: syzbot+27c62742ccfde7447505@syzkaller.appspotmail.com
First crash: 176d, last: 42d
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) -1 3 1278d 1348d 0/4 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc (5) -1 4 524d 671d 0/4 auto-obsoleted due to no activity on 2025/07/12 07:43
openbsd uvm_fault: ffs2_balloc (6) -1 10 284d 371d 0/4 auto-obsoleted due to no activity on 2026/03/09 12:43
openbsd uvm_fault: ffs2_balloc -1 1 1647d 1647d 0/4 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) -1 5 869d 973d 0/4 auto-obsoleted due to no activity on 2024/07/31 16:15
openbsd uvm_fault: ffs2_balloc (4) -1 17 734d 745d 0/4 auto-obsoleted due to no activity on 2024/11/04 07:48

Sample crash report:
uvm_fault(0xffffffff839ff588, 0xffff8000272f2008, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs2_balloc+0xa0a:      movq    0(%rcx,%rax,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*373567  87688      0           0  0x4000001    0  syz-executor
ffs2_balloc(fffff4006db7e400,349f1,50,fffff40007ffd680,1,ffff8000338bd538) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff8000338bd5c0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffff40065bfedd0,ffff8000338bd670,3,fffff40007ffd680) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff800035cda2c0,fffff40065bfedd0,fffff40007ffd680,ffff8000338bd740,ffff8000338bd720) at ktrwriteraw+0x19b sys/kern/kern_ktrace.c:692
ktrsysret(ffff800035cda2c0,36,0,ffff8000338bd800) at ktrsysret+0x17f ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff800035cda2c0,36,0,ffff8000338bd800) at ktrsysret+0x17f sys/kern/kern_ktrace.c:209
syscall(ffff8000338bd8b0) at syscall+0xad9 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff8000338bd8b0) at syscall+0xad9 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x618593598f0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839ff588, 0xffff8000272f2008, 0, 1) -> d
ddb> show kasan
No such command
ddb> trace
ffs2_balloc(fffff4006db7e400,349f1,50,fffff40007ffd680,1,ffff8000338bd538) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff8000338bd5c0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffff40065bfedd0,ffff8000338bd670,3,fffff40007ffd680) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff800035cda2c0,fffff40065bfedd0,fffff40007ffd680,ffff8000338bd740,ffff8000338bd720) at ktrwriteraw+0x19b sys/kern/kern_ktrace.c:692
ktrsysret(ffff800035cda2c0,36,0,ffff8000338bd800) at ktrsysret+0x17f ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff800035cda2c0,36,0,ffff8000338bd800) at ktrsysret+0x17f sys/kern/kern_ktrace.c:209
syscall(ffff8000338bd8b0) at syscall+0xad9 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff8000338bd8b0) at syscall+0xad9 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x618593598f0, count: -7
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff8000338bd4e0
rbx               0xfffff4006db7e400
rdx               0xffff8000015ecd00
rcx               0xffff8000272f2000
rax                              0x1
r8                0xffffffffffffffff
r9                0xffff8000338bd538
r10               0x93a21bbdd4ab2b98
r11               0xcec60e9466dab6d3
r12                              0x1
r13               0xffff800000c48800
r14               0xffff8000338bd380
r15               0xfffff40060210118
rip               0xffffffff8294e52a    ffs2_balloc+0xa0a
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff8000338bd370
ss                              0x10
ffs2_balloc+0xa0a:      movq    0(%rcx,%rax,8),%r14
ddb> show proc
PROC (syz-executor) tid=373567 pid=87688 tcnt=2 stat=onproc
    flags process=0 proc=4000001<INKTR,THREAD>
    runpri=32, usrpri=86, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800035cdafb8,0xffffffff839fe518
    process=0xffff800045ff9f98 user=0xffff8000338b8000, vmspace=0xfffff4007f22ea10
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0
ddb> 

Crashes (392):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/08 05:40 openbsd d607cd596f17 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/08 03:25 openbsd d607cd596f17 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/06 10:01 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/05 20:18 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/05 02:58 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/04 14:33 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/04 09:46 openbsd 3ee0646fca13 9451e17e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/03 22:14 openbsd 8bdaccf9d694 6b7c9f71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/02 00:30 openbsd 59ec3ab4d107 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/08/01 04:25 openbsd ec875f0e6c74 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/31 13:05 openbsd 6bf809100faf db462e94 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/27 19:04 openbsd 03525b20a4f0 1f273138 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/20 15:05 openbsd 3406bb49e583 4763fed7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/20 06:23 openbsd 16594d90c4be 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/17 23:26 openbsd 97f4e10dc0be 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/17 09:23 openbsd 94b919120046 7f27c57a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/12 10:14 openbsd e38f82204f65 d78ea535 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/10 08:47 openbsd 21e28dfa3cff 4167ee25 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/08 02:13 openbsd 59464ad990e2 88a4b44c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/07 17:32 openbsd afaaa4e34da1 fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/07 11:40 openbsd afaaa4e34da1 fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/06 21:57 openbsd 228829a254a6 fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/05 16:17 openbsd e9996feb4a0b fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/05 09:51 openbsd e9996feb4a0b fcece630 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/03 03:12 openbsd de19110b06a6 58bf2096 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/07/02 13:25 openbsd 30d0e3967450 27192279 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/29 11:25 openbsd eed6eb79f3a4 6a0c72dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/29 04:16 openbsd a0c937b71e27 fb92f11c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/25 19:52 openbsd 452256cb16b9 432fd51a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/25 14:29 openbsd 452256cb16b9 432fd51a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/24 07:38 openbsd 26c6eebc6662 042555ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/23 05:36 openbsd aa0f58e8a9e2 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/21 21:06 openbsd 500e6e56a2c4 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/21 07:43 openbsd ecd9e3ee9311 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/20 23:42 openbsd ecd9e3ee9311 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/20 01:05 openbsd e313e922acbc 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/19 17:07 openbsd e313e922acbc 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/18 21:05 openbsd aad3118e28ac 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 23:59 openbsd abb34060f546 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 20:10 openbsd abb34060f546 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 12:30 openbsd abb34060f546 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 10:42 openbsd 2f229140c828 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 08:53 openbsd 2f229140c828 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/26 03:40 openbsd 61b7e18e5713 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 02:05 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.