syzbot


uvm_fault: ffs_nodealloccg (3)

Status: upstream: reported on 2025/09/26 04:08
Reported-by: syzbot+546e2cd879b0f7313b6d@syzkaller.appspotmail.com
First crash: 19d, last: 19d
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs_nodealloccg -1 1 1360d 1360d 0/3 auto-closed as invalid on 2022/04/24 17:10
openbsd uvm_fault: ffs_nodealloccg (2) -1 2 396d 397d 0/3 auto-obsoleted due to no activity on 2024/12/13 04:19

Sample crash report:
uvm_fault(0xffffffff838e9870, 0xffff800027c92004, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs_nodealloccg+0x13c:  movl    0x4(%rbx),%r15d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 284556  57587      0           0          0    0  syz-executor
*165473  79710      0         0x2          0    1K syz-executor
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c sys/ufs/ffs/ffs_alloc.c:1106
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:824 [inline]
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 sys/ufs/ffs/ffs_alloc.c:390
ufs_mkdir(ffff80002a349d60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
VOP_MKDIR(fffffd806f11edb0,ffff80002a349ec0,ffff80002a349ef0,ffff80002a349df0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff80003c40b4e0,ffffff9c,788bc45f3530,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3113
syscall(ffff80002a34a070) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a34a070) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x788bc45f34f0, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}> 
ddb{1}> set $lines = 0
ddb{1}> set $maxwidth = 0
ddb{1}> show panic
*cpu1: uvm_fault(0xffffffff838e9870, 0xffff800027c92004, 0, 1) -> d
ddb{1}> trace
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c sys/ufs/ffs/ffs_alloc.c:1106
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:824 [inline]
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 sys/ufs/ffs/ffs_alloc.c:390
ufs_mkdir(ffff80002a349d60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
VOP_MKDIR(fffffd806f11edb0,ffff80002a349ec0,ffff80002a349ef0,ffff80002a349df0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff80003c40b4e0,ffffff9c,788bc45f3530,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3113
syscall(ffff80002a34a070) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a34a070) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x788bc45f34f0, count: -7
ddb{1}> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a349b10
rbx               0xffff800027c92000
rdx                                0
rcx               0xffff80003c40b4e0
rax               0xffff8000299edff0
r8                0xffffffffffffffff
r9                                 0
r10               0xa7d3a9ef3f953c97
r11               0x44ee13a09188edc3
r12               0xffff800000b50000
r13               0xfffffd805bd66460
r14                              0x5
r15                                0
rip               0xffffffff81bd50dc    ffs_nodealloccg+0x13c
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a349a60
ss                              0x10
ffs_nodealloccg+0x13c:  movl    0x4(%rbx),%r15d
ddb{1}> show proc
PROC (syz-executor) tid=165473 pid=79710 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=50, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80003c40a7e8,0xffff80003c40b788
    process=0xffff80002a3ceb68 user=0xffff80002a345000, vmspace=0xfffffd800b0273d0
    estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=0
ddb{1}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 57587  284556  40033      0  7           0                syz-executor
*79710  165473  40033      0  7         0x2                syz-executor
 64837   29507  40033      0  2           0                syz-executor
  1339  492914      0      0  3     0x14200  acct          acct
 62766   97159      0      0  3     0x14280  nfsidl        nfsio
 31275  391530      0      0  3     0x14280  nfsidl        nfsio
 91562  332256      0      0  3     0x14280  nfsidl        nfsio
 84036  376690      0      0  3     0x14280  nfsidl        nfsio
 71839  371074      0      0  3     0x14200  bored         sosplice
 40033   75045  32447      0  2  0x10000002                syz-executor
 32447  451096  38136      0  3    0x10008a  sigsusp       ksh
 38136  391398  65417      0  3        0x98  kqread        sshd-session
 65417  169125  86581      0  3        0x92  kqread        sshd-session
 61344  387727      1      0  3    0x100083  ttyopn        getty
 86581  396012      1      0  3        0x88  kqread        sshd
 91260  188062  71883     74  3   0x1100092  bpf           pflogd
 71883  494771      1      0  3        0x80  sbwait        pflogd
 66254   66453  61363     73  3   0x1100090  kqread        syslogd
 61363  323815      1      0  3    0x100082  sbwait        syslogd
 84514  110094      1      0  3    0x100080  kqread        resolvd
 18747  354459  68952     77  3    0x100092  kqread        dhcpleased
 50820    3820  68952     77  3    0x100092  kqread        dhcpleased
 68952    7393      1      0  3        0x80  kqread        dhcpleased
 56653  483770      0      0  3     0x14200  bored         smr
 45125  299793      0      0  2     0x14200                zerothread
 22428  166274      0      0  3     0x14200  aiodoned      aiodoned
 70957   64851      0      0  3     0x14200  syncer        update
  7892  252879      0      0  3     0x14200  cleaner       cleaner
  7327  368440      0      0  3     0x14200  reaper        reaper
 94078  167291      0      0  3     0x14200  pgdaemon      pagedaemon
 87050  211177      0      0  3     0x14200  bored         viomb
 11039   57942      0      0  3  0x40014200  acpi0         acpi0
 96983  366943      0      0  3  0x40014200                idle1
 55910  218336      0      0  3     0x14200  bored         softnet1
 28052  154398      0      0  3     0x14200  bored         softnet0
 65241  447556      0      0  3     0x14200  smrbar        systqmp
 58152  424972      0      0  3     0x14200  bored         systq
 23237  291763      0      0  3     0x14200  tmoslp        softclockmp
 72035  380205      0      0  3  0x40014200  tmoslp        softclock
 84691   20862      0      0  3  0x40014200                idle0
     1  165160      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{1}> show all locks
Process 79710 (syz-executor) thread 0xffff80003c40b4e0 (165473)
exclusive rrwlock inode r = 0 (0xfffffd806f30fa18)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xa3 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vfs_lookup+0x11c sys/kern/vfs_lookup.c:-1
#6  namei+0x7ca sys/kern/vfs_lookup.c:250
#7  domkdirat+0x8b sys/kern/vfs_syscalls.c:3098
#8  syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xb17 sys/arch/amd64/amd64/trap.c:748
#9  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83921c38)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
#1  syscall+0xaf4 sys/arch/amd64/amd64/trap.c:748
#2  Xsyscall+0x128
Process 65241 (systqmp) thread 0xffff8000ffffecf8 (447556)
shared rwlock systqmp r = 0 (0xffffffff837a1ee8)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  taskq_thread+0x12a sys/kern/kern_task.c:442
#2  proc_trampoline+0x10
ddb{1}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10178  11002K   11472K 166960K     12015        0
            pcb    17     13K      20K 166960K       270        0
         rtable    67      6K      10K 166960K       376        0
             pf    19     15K      30K 166960K       133        0
         ifaddr    11      1K       8K 166960K        84        0
        ifgroup    22      1K       2K 166960K       113        0
         sysctl     3      1K       9K 166960K        14        0
       counters    52     34K      38K 166960K       208        0
       ioctlops     0      0K       4K 166960K      1608        0
            iov     0      0K      20K 166960K        98        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1456     92K      92K 166960K      1998        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       9K 166960K        11        0
         VM map     2      1K       1K 166960K         2        0
            sem    15      1K       1K 166960K        27        0
        dirhash    12      2K       2K 166960K        24        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc     5      4K     240K 166960K       729        0
          sigio     0      0K       0K 166960K         7        0
           proc    72    115K     196K 166960K       635        0
        subproc     0      0K       4K 166960K        91        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K        64        0
       in_multi    11      0K       7K 166960K       150        0
    ether_multi     1      0K       0K 166960K         6        0
            mrt     0      0K       0K 166960K         4        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   103    466K     466K 166960K       103        0
           exec     0      0K       1K 166960K       501        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   132     92K     181K 166960K      8165        0
       UVM aobj    17      2K       2K 166960K        18        0
     pinsyscall    30     60K     105K 166960K      1907        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        29        0
            NDP     4      0K       2K 166960K        55        0
           temp    36   8652K    8719K 166960K     35400        0
         kqueue    13     20K      30K 166960K       129        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{1}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120       96    0       93     1     0     1     1     0     8    0
rtentry    176      131    0      118     5     0     5     5     0     8    3
unpcb      144      543    0      526     6     0     6     6     0     8    5
syncache   336        6    0        6     1     1     0     1     0     8    0
tcpcb      736      135    0      131     2     0     2     2     0     8    1
arp        136       14    0       11     1     0     1     1     0     8    0
inpcb      328      640    0      633     4     0     4     4     0     8    3
nd6        152       24    0       24     1     0     1     1     0     8    1
pkpcb       40        4    0        4     2     2     0     1     0     8    0
kcovpl      48       10    0       10     1     0     1     1     0     8    1
ppxss      1192      65    0       65     1     0     1     1     0     8    1
pppxif     1504       2    0        2     1     0     1     1     0     8    1
pfstscr     40        1    0        1     1     1     0     1     0     8    0
pffrag     232        3    0        0     1     0     1     1     0   482    0
pffrnode    88        2    0        0     1     0     1     1     0     8    0
pffrent     40        4    0        1     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfanchor   1288       5    0        0     1     0     1     1     0     8    0
pftag       88        2    0        0     1     0     1     1     0     8    0
pfstitem    24       46    0       13     1     0     1     1     0     8    0
pfstkey    128       48    0       15     2     0     2     2     0     8    0
pfstate    384       46    0       14     4     0     4     4     0     8    0
pfrule     1344      25    0       19     2     1     1     2     0     8    0
rttmr      136        1    0        1     1     1     0     1     0     8    0
art_heap8  4096       3    0        0     3     0     3     3     0     8    0
art_heap4  256      607    0      473    30     5    25    30     0     8   10
art_table   40      610    0      473     5     0     5     5     0     8    0
art_node    32      130    0      114     1     0     1     1     0     8    0
sysvmsgpl   40       12    0        4     1     0     1     1     0     8    0
semupl     112        3    0        3     1     1     0     1     0     8    0
semapl     112       20    0        7     1     0     1     1     0     8    0
shmpl      112       15    0        1     1     0     1     1     0     8    0
dirhash    1024      25    0        8     3     0     3     3     0     8    0
dino2pl    256     2587    0     1075    96     0    96    96     0     8    0
ffsino     296     2624    0     1112   118     0   118   118     0     8    0
nchpl      144     3475    0     1780    64     0    64    64     0     8    0
rtmask      32        8    0        8     1     0     1     1     0     8    1
vnodes     216     3109    0        0   173     0   173   173     0     8    0
namei      1024   12190    0    12189     3     2     1     2     0     8    0
percpumem   16      119    0       78     1     0     1     1     0     8    0
kstatmem   264       72    0       62     3     0     3     3     0     8    2
scxspl     216    19657    0    19657     9     7     2     8     1     8    2
plimitpl   152      222    0      207     1     0     1     1     0     8    0
sigapl     424     1057    0     1011     8     1     7     7     0     8    1
knotepl    120      522    0        0    16     0    16    16     0     8    0
kqueuepl   224      261    0      252     2     1     1     2     0     8    0
pipepl     344      311    0      281     6     1     5     6     0     8    1
fdescpl    528      979    0      960     3     0     3     3     0     8    1
filepl     160     6133    0     6017    19     4    15    19     0     8    8
lockfpl    104      298    0      296     1     0     1     1     0     8    0
lockfspl    48      131    0      129     1     0     1     1     0     8    0
sessionpl  144       24    0       15     1     0     1     1     0     8    0
pgrppl      48       78    0       61     1     0     1     1     0     8    0
ucredpl    104      783    0      770     1     0     1     1     0     8    0
zombiepl   144     1016    0     1011     1     0     1     1     0     8    0
processpl  1232    1057    0     1011     5     0     5     5     0     8    0
procpl     664     1992    0     1946     7     0     7     7     0     8    1
sosppl     168        1    0        1     1     1     0     1     0     8    0
sockpl     752     1364    0     1337    18     0    18    18     0     8   15
mcl64k     65536     18    0        0     3     0     3     3     0     8    0
mcl16k     16384      2    0        0     1     0     1     1     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     115    0        0    15     0    15    15     0     8    0
mcl2k      2048      30    0        0     4     0     4     4     0     8    0
mtagpl      96        3    0        0     1     0     1     1     0     8    0
mbufpl     256      230    0        0    15     0    15    15     0     8    0
bufpl      280     8057    0     1914   439     0   439   439     0     8    0
anonpl      32    12363    0        0   101     1   100   100     0   246    0
amapchunkpl 152   27451    0    27251    35     5    30    31     0   158   20
amappl16   200     4111    0     4104    38    28    10    31     0     8    8
amappl15   192        3    0        3     1     1     0     1     0     8    0
amappl14   184      116    0      104     1     0     1     1     0     8    0
amappl13   176        6    0        6     1     1     0     1     0     8    0
amappl12   168     1693    0     1675     4     2     2     3     0     8    0
amappl11   160       96    0       82     1     0     1     1     0     8    0
amappl10   152        8    0        8     1     1     0     1     0     8    0
amappl9    144      248    0      248     1     1     0     1     0     8    0
amappl8    136       24    0       20     1     0     1     1     0     8    0
amappl7    128      111    0       98     1     0     1     1     0     8    0
amappl6    120      200    0      197     1     0     1     1     0     8    0
amappl5    112      141    0      132     1     0     1     1     0     8    0
amappl4    104      299    0      278     1     0     1     1     0     8    0
amappl3     96     4367    0     4323     3     0     3     3     0     8    0
amappl2     88     1211    0     1147     2     0     2     2     0     8    0
amappl1     80    10677    0    10148    15     2    13    15     0     8    0
amappl      88     7313    0     7245     5     0     5     5     0    92    1
uvmvnodes   80     3109    0        0    64     0    64    64     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      253    0      253     1     1     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       17    0        1     1     0     1     1     0     8    0
uaddrrnd    24      979    0      960     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24      979    0      960     1     0     1     1     0     8    0
vmmpekpl   168     9851    0     9813     3     0     3     3     0     8    0
vmmpepl    168    68882    0    67492   117     4   113   114     0   357   32
vmsppl     488      978    0      960     7     2     5     5     0     8    2
rwobjpl     80    23929    0    20099    87     0    87    87     0     8    0
pdppl      4096    1966    0     1920   102    46    56    86     0     8   10
pvpl        32    19467    0        0   158     1   157   157     0   265    0
pmappl     256      978    0      960     3     0     3     3     0     8    1
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      285    0       56     8     0     8     8     0     8    0
ddb{1}> machine ddbcpu 0
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffffffff8380cff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83921a30) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff83921a30) at __mp_lock+0x192 sys/kern/kern_lock.c:165
syscall(ffff80002a30c5b0) at syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff80002a30c5b0) at syscall+0xaf4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x752cd9d09130, count: 9
ddb{0}> trace
x86_ipi_db(ffffffff8380cff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
__mp_lock(ffffffff83921a30) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:134 [inline]
__mp_lock(ffffffff83921a30) at __mp_lock+0x192 sys/kern/kern_lock.c:165
syscall(ffff80002a30c5b0) at syscall+0xaf4 mi_syscall sys/sys/syscall_mi.h:175 [inline]
syscall(ffff80002a30c5b0) at syscall+0xaf4 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x752cd9d09130, count: -6
ddb{0}> machine ddbcpu 1
Stopped at      ffs_nodealloccg+0x13c:  movl    0x4(%rbx),%r15d
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c sys/ufs/ffs/ffs_alloc.c:1106
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:824 [inline]
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 sys/ufs/ffs/ffs_alloc.c:390
ufs_mkdir(ffff80002a349d60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
VOP_MKDIR(fffffd806f11edb0,ffff80002a349ec0,ffff80002a349ef0,ffff80002a349df0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff80003c40b4e0,ffffff9c,788bc45f3530,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3113
syscall(ffff80002a34a070) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a34a070) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x788bc45f34f0, count: 8
ddb{1}> trace
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_nodealloccg(fffffd806f30f978,5,0,41c0) at ffs_nodealloccg+0x13c sys/ufs/ffs/ffs_alloc.c:1106
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:824 [inline]
ffs_inode_alloc(fffffd806f30f978,41c0,fffffd80097fb8f0,ffff80002a349cf8) at ffs_inode_alloc+0x345 sys/ufs/ffs/ffs_alloc.c:390
ufs_mkdir(ffff80002a349d60) at ufs_mkdir+0xfc sys/ufs/ufs/ufs_vnops.c:1112
VOP_MKDIR(fffffd806f11edb0,ffff80002a349ec0,ffff80002a349ef0,ffff80002a349df0) at VOP_MKDIR+0x101 sys/kern/vfs_vops.c:394
domkdirat(ffff80003c40b4e0,ffffff9c,788bc45f3530,1c0) at domkdirat+0x179 sys/kern/vfs_syscalls.c:3113
syscall(ffff80002a34a070) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80002a34a070) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x788bc45f34f0, count: -7

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/26 04:08 openbsd bdcea57388aa 770ff59f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs_nodealloccg
* Struck through repros no longer work on HEAD.