syzbot


uvm_fault: ufs_direnter (4)

Status: upstream: reported on 2025/02/06 09:55
Reported-by: syzbot+3992fb489353823ea643@syzkaller.appspotmail.com
First crash: 13d, last: 13d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ufs_direnter (2) 1 334d 334d 0/3 auto-obsoleted due to no activity on 2024/06/20 10:15
openbsd uvm_fault: ufs_direnter 1 874d 874d 0/3 auto-obsoleted due to no activity on 2022/12/28 17:05
openbsd uvm_fault: ufs_direnter (3) 3 157d 159d 0/3 auto-obsoleted due to no activity on 2024/12/14 08:05

Sample crash report:
login: uvm_fault(0xffffffff83565530, 0xffff800029de200c, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ufs_direnter+0x23c:     movl    0(%r15),%r14d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*519562  80111      0         0x2          0    0  syz-executor
ufs_direnter(fffffd80776762c0,fffffd805e9f10f8,ffff80002a926fd0,ffff80002a9272f0,fffffd806a4f9d20) at ufs_direnter+0x23c sys/ufs/ufs/ufs_lookup.c:764
ufs_mkdir(ffff80002a927160) at ufs_mkdir+0x60f sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(fffffd80776762c0,ffff80002a9272c0,ffff80002a9272f0,ffff80002a9271f0) at VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
domkdirat(ffff80002a85a540,ffffff9c,70a614239d20,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3102
syscall(ffff80002a927470) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70a614239dc0, count: 9
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83565530, 0xffff800029de200c, 0, 1) -> d
ddb> trace
ufs_direnter(fffffd80776762c0,fffffd805e9f10f8,ffff80002a926fd0,ffff80002a9272f0,fffffd806a4f9d20) at ufs_direnter+0x23c sys/ufs/ufs/ufs_lookup.c:764
ufs_mkdir(ffff80002a927160) at ufs_mkdir+0x60f sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(fffffd80776762c0,ffff80002a9272c0,ffff80002a9272f0,ffff80002a9271f0) at VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
domkdirat(ffff80002a85a540,ffffff9c,70a614239d20,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3102
syscall(ffff80002a927470) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70a614239dc0, count: -6
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a926fc0
rbx               0xfffffd805e3324e0
rdx                                0
rcx               0xfffffd805cf98a48
rax               0xffff80002a85a540
r8                0xffffffffffffffff
r9                                 0
r10               0x33d451612cbe3018
r11               0x5354c7064e1cc40a
r12               0xfffffd806e5cd800
r13               0xfffffd805e9f10f8
r14                            0x200
r15               0xffff800029de200c
rip               0xffffffff821465fc    ufs_direnter+0x23c
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a926f10
ss                              0x10
ufs_direnter+0x23c:     movl    0(%r15),%r14d
ddb> show proc
PROC (syz-executor) tid=519562 pid=80111 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=17, usrpri=50, slppri=17, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a85a030,0xffff80002a882028
    process=0xffff80002a99a6f8 user=0xffff80002a922000, vmspace=0xfffffd806c1e6178
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=3, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 61477   97465  27871      0  2           0                syz-executor
 61477  483304  27871      0  2   0x4000000                syz-executor
 48473   89707  23008      0  2           0                syz-executor
 48473  473504  23008      0  3   0x4000080  ttyout        syz-executor
 19779   70917  39539      0  2           0                syz-executor
 19779  341359  39539      0  2   0x4000000                syz-executor
  4876  321751  82521      0  2   0x1000000                syz-executor
  4876   45106  82521      0  3   0x5000080  fsleep        syz-executor
 58755  515446  76788      0  2           0                syz-executor
 58755  440195  76788      0  3   0x4000080  kqpoll        syz-executor
 37576   17391  39019      0  2   0x1000480                syz-executor
 37576  435706  39019      0  3   0x5000080  sbwait        syz-executor
 37576  295305  39019      0  3   0x5000080  fsleep        syz-executor
 69656   46297  37055      0  2        0x10                syz-executor
 69656  142833  37055      0  3   0x4000090  fsleep        syz-executor
 69846  137765      1      0  3    0x100083  ttyin         getty
*80111  519562  78279      0  7         0x2                syz-executor
 39539  401698  78279      0  2       0x482                syz-executor
 39019  298566  78279      0  2       0x482                syz-executor
 37055  379328  78279      0  2       0x482                syz-executor
 76788  179738  78279      0  2       0x482                syz-executor
 67674  234131      0      0  3     0x14200  bored         sosplice
 82521  372626  78279      0  2       0x482                syz-executor
 23008  321328  78279      0  2       0x482                syz-executor
 27871  271372  78279      0  2       0x482                syz-executor
 78279  521506  24405      0  2         0x2                syz-executor
 24405  318527  31763      0  3    0x10008a  sigsusp       ksh
 31763   90475  27018      0  3        0x98  kqread        sshd-session
 27018  401547  10352      0  3        0x92  kqread        sshd-session
 10352   85838      1      0  3        0x88  kqread        sshd
  4822  379993  55763     73  3   0x1100090  kqread        syslogd
 55763  347406      1      0  3    0x100082  sbwait        syslogd
 81848  182571      1      0  3    0x100080  kqread        resolvd
 23575  138002  85670     77  3    0x100092  kqread        dhcpleased
 36913  439099  85670     77  3    0x100092  kqread        dhcpleased
 85670  124391      1      0  3        0x80  kqread        dhcpleased
 95781  307635      0      0  3     0x14200  bored         smr
 23802  421873      0      0  2     0x14200                zerothread
 57101  334711      0      0  3     0x14200  aiodoned      aiodoned
 45325  326434      0      0  3     0x14200  syncer        update
 93726   21278      0      0  3     0x14200  cleaner       cleaner
 65522   43931      0      0  3     0x14200  reaper        reaper
 65478  185706      0      0  3     0x14200  pgdaemon      pagedaemon
 94366   90477      0      0  3     0x14200  bored         viomb
 87567  299636      0      0  3  0x40014200  acpi0         acpi0
 17551  104910      0      0  3     0x14200  bored         softnet3
 21942   80356      0      0  3     0x14200  bored         softnet2
 83359  115498      0      0  3     0x14200  bored         softnet1
 96950  340073      0      0  3     0x14200  bored         softnet0
 54213  135889      0      0  3     0x14200  bored         systqmp
 57292  406483      0      0  3     0x14200  bored         systq
 42797  466828      0      0  2  0x40014200                softclock
 33334  394224      0      0  3  0x40014200                idle0
     1  175375      0      0  3     0x80082  wait          init
     0       0     -1      0  3     0x10200  scheduler     swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10205  11060K   11585K 166960K     14682        0
            pcb    17     14K      16K 166960K       640        0
         rtable   167      6K       8K 166960K       939        0
             pf    33     14K      22K 166960K       180        0
         ifaddr    31      5K       8K 166960K       123        0
        ifgroup    42      1K       2K 166960K       198        0
         sysctl     4      1K       1K 166960K        14        0
       counters    28     17K      17K 166960K        71        0
       ioctlops     0      0K       4K 166960K       280        0
            iov     0      0K      20K 166960K       280        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1451     91K      92K 166960K      3671        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        36        0
         VM map     2      1K       1K 166960K         2        0
            sem    25     17K      17K 166960K        71        0
        dirhash    12      2K       3K 166960K        63        0
           ACPI  1690    195K     286K 166960K     12468        0
      file desc    17     61K      85K 166960K      2405        0
          sigio     0      0K       0K 166960K       134        0
           proc    64     67K     100K 166960K       878        0
        subproc    72      4K       4K 166960K       147        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       285        0
       in_multi    66      4K       7K 166960K       247        0
    ether_multi     1      0K       0K 166960K        14        0
            mrt     1      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   241   1076K    1076K 166960K       241        0
           exec     0      0K       1K 166960K       917        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         6        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   214     72K      91K 166960K     22767        0
       UVM aobj    33      2K       4K 166960K        37        0
     pinsyscall    38     76K      90K 166960K      3643        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K       130        0
            NDP     9      0K       2K 166960K        90        0
           temp    76   6892K    7020K 166960K     96930        0
         kqueue    14     22K      34K 166960K       458        0
      SYN cache     2     16K      16K 166960K         2        0
ddb> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
rtpcb      120      438    0      435     4     2     2     3     0     8    1
rtentry    112      261    0      189     4     1     3     4     0     8    0
unpcb      144     1578    0     1557    10     6     4     4     0     8    3
syncache   336        6    0        6     3     2     1     1     0     8    1
tcpqe       32        1    0        1     1     0     1     1     0     8    1
tcpcb      808      926    0      921    17    12     5     7     0     8    4
arp         88       49    0       36     1     0     1     1     0     8    0
ipq         40        9    0        8     1     0     1     1     0     8    0
ipqe        40      108    0      107     1     0     1     1     0     8    0
inpcb      344     3408    0     3399    23    15     8    10     0     8    7
ip6q        72        1    0        1     1     0     1     1     0     8    1
ip6af       40        2    0        2     1     0     1     1     0     8    1
nd6        104       59    0       41     1     0     1     1     0     8    0
pkpcb       40       22    0       22     3     2     1     1     0     8    1
kcovpl      48       16    0        8     1     0     1     1     0     8    0
ppxss      1072      17    0       17     3     2     1     1     0     8    1
pfstscr     40        4    0        4     4     3     1     1     0     8    1
pfanchor   1288       4    0        0     1     0     1     1     0     8    0
pftag       88        1    0        0     1     0     1     1     0     8    0
pfstitem    24        9    0        2     1     0     1     1     0     8    0
pfstkey    128       23    0       16     2     1     1     1     0     8    0
pfstate    344       16    0       12     2     1     1     1     0     8    0
pfrule     1344      15    0       15     3     2     1     1     0     8    1
art_heap8  4096       4    0        1     4     1     3     3     0     8    0
art_heap4  256     1080    0      733    33     6    27    33     0     8    0
art_table   32     1084    0      734     5     0     5     5     0     8    0
art_node    16      254    0      190     1     0     1     1     0     8    0
semupl     112        4    0        4     1     1     0     1     0     8    0
semapl     112       59    0       36     1     0     1     1     0     8    0
shmpl      112       34    0        4     1     0     1     1     0     8    0
dirhash    1024      52    0       35     3     0     3     3     0     8    0
dino2pl    256     5638    0     4133    95     0    95    95     0     8    0
ffsino     248     5638    0     4133    95     0    95    95     0     8    0
nchpl      144     9036    0     8476    64    32    32    64     0     8    8
uvmvnodes   80     7103    0        0   145     0   145   145     0     8    0
vnodes     216     7103    0        0   395     0   395   395     0     8    0
namei      1024   32894    0    32893     4     3     1     2     0     8    0
kstatmem   264      104    0       86     2     0     2     2     0     8    0
scsiplug    72       13    0       13     3     2     1     1     0     8    1
scxspl     216    25587    0    25587    15    12     3     8     1     8    3
plimitpl   152      983    0      964     1     0     1     1     0     8    0
sigapl     424     2692    0     2646     8     1     7     8     0     8    0
futexpl     64    35071    0    35068     1     0     1     1     0     8    0
knotepl    120   606822    0   606775    61    51    10    28     0     8    5
kqueuepl   184      781    0      769     4     3     1     4     0     8    0
pipepl     296      602    0      575    13    10     3     8     0     8    0
fdescpl    440     2652    0     2623     4     0     4     4     0     8    0
filepl     120    19988    0    19765    24    12    12    17     0     8    3
lockfpl    104      830    0      828     1     0     1     1     0     8    0
lockfspl    48      285    0      283     1     0     1     1     0     8    0
sessionpl  144       31    0       23     1     0     1     1     0     8    0
pgrppl      48       76    0       60     1     0     1     1     0     8    0
ucredpl    104     3612    0     3598     1     0     1     1     0     8    0
zombiepl   144     2646    0     2646     3     2     1     1     0     8    1
processpl  1104    2692    0     2646     6     1     5     6     0     8    0
procpl     648     5829    0     5775     7     1     6     7     0     8    0
sosppl     168        6    0        6     2     1     1     1     0     8    1
sockpl     528     5925    0     5892    27    17    10    14     0     8    7
mcl64k     65536     41    0       41     3     2     1     1     0     8    1
mcl16k     16384     17    0       17     3     2     1     1     0     8    1
mcl12k     12288      5    0        5     2     1     1     1     0     8    1
mcl8k      8192      97    0       97     4     3     1     1     0     8    1
mcl4k      4096    5514    0     5456    14     6     8    13     0     8    0
mcl2k2     2112       2    0        2     1     1     0     1     0     8    0
mcl2k      2048    2688    0     2675     6     3     3     4     0     8    0
mtagpl      96      150    0       51     3     0     3     3     0     8    0
mbufpl     256    37544    0    37301    53    27    26    35     0     8    6
bufpl      280     7515    0     1276   446     0   446   446     0     8    0
anonpl      24   340841    0   329776   115    22    93    95     0   187    5
amapchunkpl 152   76257    0    75693    40    11    29    33     0   158    4
amappl16   200     7593    0     7169    62    27    35    35     0     8    3
amappl15   192        4    0        4     1     1     0     1     0     8    0
amappl14   184      123    0      113     1     0     1     1     0     8    0
amappl13   176        7    0        7     2     2     0     1     0     8    0
amappl12   168     3415    0     3386     2     0     2     2     0     8    0
amappl11   160       46    0       36     1     0     1     1     0     8    0
amappl10   152       12    0       12     4     3     1     1     0     8    1
amappl9    144      248    0      248     1     1     0     1     0     8    0
amappl8    136       40    0       38     1     0     1     1     0     8    0
amappl7    128      118    0      106     1     0     1     1     0     8    0
amappl6    120      253    0      248     1     0     1     1     0     8    0
amappl5    112      145    0      138     1     0     1     1     0     8    0
amappl4    104      308    0      291     1     0     1     1     0     8    0
amappl3     96    15660    0    15552     4     0     4     4     0     8    0
amappl2     88      804    0      748     2     0     2     2     0     8    0
amappl1     80    14798    0    14278    15     3    12    13     0     8    0
amappl      88    22219    0    22053     5     0     5     5     0    92    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma512     512        1    0        1     1     1     0     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      260    0      260     4     3     1     1     0     8    1
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       20    0       19     1     0     1     1     0     8    0
aobjpl      72       36    0        4     1     0     1     1     0     8    0
uaddrrnd    24     2652    0     2623     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     2652    0     2623     1     0     1     1     0     8    0
vmmpekpl   168    19476    0    19430     3     0     3     3     0     8    0
vmmpepl    168   161853    0   159719   120    13   107   107     0   357    5
vmsppl     360     2651    0     2623     4     1     3     4     0     8    0
rwobjpl     32    47440    0    39059    69     0    69    69     0     8    0
pdppl      4096    5310    0     5246   136    70    66    76     0     8    2
pvpl        32  1080431    0  1063823   248    51   197   197     0   265   43
pmappl     216     2651    0     2623     2     0     2     2     0     8    0
extentpl    40       55    0       38     1     0     1     1     0     8    0
phpool     112      382    0      140     8     0     8     8     0     8    0
ddb> machine ddbcpu 0
No such command
ddb> trace
ufs_direnter(fffffd80776762c0,fffffd805e9f10f8,ffff80002a926fd0,ffff80002a9272f0,fffffd806a4f9d20) at ufs_direnter+0x23c sys/ufs/ufs/ufs_lookup.c:764
ufs_mkdir(ffff80002a927160) at ufs_mkdir+0x60f sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(fffffd80776762c0,ffff80002a9272c0,ffff80002a9272f0,ffff80002a9271f0) at VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
domkdirat(ffff80002a85a540,ffffff9c,70a614239d20,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3102
syscall(ffff80002a927470) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70a614239dc0, count: -6
ddb> machine ddbcpu 1
No such command
ddb> trace
ufs_direnter(fffffd80776762c0,fffffd805e9f10f8,ffff80002a926fd0,ffff80002a9272f0,fffffd806a4f9d20) at ufs_direnter+0x23c sys/ufs/ufs/ufs_lookup.c:764
ufs_mkdir(ffff80002a927160) at ufs_mkdir+0x60f sys/ufs/ufs/ufs_vnops.c:1179
VOP_MKDIR(fffffd80776762c0,ffff80002a9272c0,ffff80002a9272f0,ffff80002a9271f0) at VOP_MKDIR+0x102 sys/kern/vfs_vops.c:394
domkdirat(ffff80002a85a540,ffffff9c,70a614239d20,1ff) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3102
syscall(ffff80002a927470) at syscall+0x97e sys/arch/amd64/amd64/trap.c:577
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x70a614239dc0, count: -6

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/06 09:54 openbsd 4a7e1005694f 1e1faf27 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_direnter
* Struck through repros no longer work on HEAD.