syzbot


uvm_fault: ffs_write

Status: upstream: reported on 2025/11/15 15:30
Reported-by: syzbot+a9245a4a93133838a030@syzkaller.appspotmail.com
First crash: 7d00h, last: 7d00h

Sample crash report:
uvm_fault(0xfffffd80744333f0, 0x18, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at      ffs_write+0x170:        movq    0x18(%rax),%r15
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
ffs_write(ffff80003c480dd0) at ffs_write+0x170 sys/ufs/ffs/ffs_vnops.c:307
VOP_WRITE(fffffd8061fda6c0,ffff80003c480e68,23,fffffd80097fd000) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_rdwr(1,fffffd8061fda6c0,ffff80003c480fa0,40,0,1,8ff0e703785b9fa4,0,1018,0) at vn_rdwr+0x12d sys/kern/vfs_vnops.c:324
acct_process(ffff8000fffef240) at acct_process+0x7a2 sys/kern/kern_acct.c:245
exit1(ffff8000fffef240,0,0,1) at exit1+0x5c4 sys/kern/kern_exit.c:228
sys_exit(ffff8000fffef240,ffff80003c4811e0,ffff80003c481130) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c4811e0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4811e0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b3fbc9a7540, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xfffffd80744333f0, 0x18, 0, 1) -> e
ddb{0}> trace
ffs_write(ffff80003c480dd0) at ffs_write+0x170 sys/ufs/ffs/ffs_vnops.c:307
VOP_WRITE(fffffd8061fda6c0,ffff80003c480e68,23,fffffd80097fd000) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_rdwr(1,fffffd8061fda6c0,ffff80003c480fa0,40,0,1,8ff0e703785b9fa4,0,1018,0) at vn_rdwr+0x12d sys/kern/vfs_vnops.c:324
acct_process(ffff8000fffef240) at acct_process+0x7a2 sys/kern/kern_acct.c:245
exit1(ffff8000fffef240,0,0,1) at exit1+0x5c4 sys/kern/kern_exit.c:228
sys_exit(ffff8000fffef240,ffff80003c4811e0,ffff80003c481130) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c4811e0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4811e0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b3fbc9a7540, count: -8
ddb{0}> show registers
rdi                                0
rsi                              0x2
rbp               0xffff80003c480dc0
rbx                             0x23
rdx                                0
rcx               0xffff8000fffef240
rax                                0
r8                                 0
r9                               0x1
r10               0xf506197080393b5b
r11               0xc848108b1b54e3d5
r12               0xfffffd806ca9a298
r13               0xffff80003c480e68
r14                             0x40
r15                              0x1
rip               0xffffffff8210bd60    ffs_write+0x170
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80003c480d00
ss                              0x10
ffs_write+0x170:        movq    0x18(%rax),%r15
ddb{0}> show proc
PROC (syz-executor) tid=130943 pid=12461 tcnt=0 stat=onproc
    flags process=1018<EXITING,SUGID,SINGLEEXIT> proc=2000<WEXIT>
    runpri=32, usrpri=83, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0xffff8000fffef240 scnt=-1 ecnt=1
    forw=0xffffffffffffffff, list=0xffff8000368014f8,0xffff800037c09258
    process=0xffff80003c4689c8 user=0xffff80003c47c000, vmspace=0xfffffd80744333f0
    estcpu=33, cpticks=4, pctcpu=0.3, user=0, sys=1, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 23431  439322  64100      0  2           0                syz-executor
 23431  326218  64100      0  3   0x4000080  bell          syz-executor
 55396  466102  43030  60929  2        0x10                syz-executor
 55396  507193  43030  60929  3   0x4000090  kqpoll        syz-executor
 73008   54831  90731      0  2           0                syz-executor
 96198  253814  23166      0  3        0x80  nanoslp       syz-executor
 96198  178433  23166      0  2   0x4000000                syz-executor
 96198  143479  23166      0  3   0x4000080  fsleep        syz-executor
 42992  307892  87237      0  2       0xc82                syz-executor
  2012  423507      0      0  3     0x14200  acct          acct
 43030  440422  87237      0  3        0x82  nanoslp       syz-executor
 62157  377809      0      0  3     0x14280  nfsidl        nfsio
 42270  144501      0      0  3     0x14280  nfsidl        nfsio
 46504  402753      0      0  3     0x14280  nfsidl        nfsio
 73380  148148      0      0  3     0x14280  nfsidl        nfsio
 48831   11977      0      0  3     0x14280  nfsidl        nfsio
 53232  452626      0      0  3     0x14280  nfsidl        nfsio
 57450  385560      0      0  3     0x14280  nfsidl        nfsio
 25330  501429      0      0  3     0x14280  nfsidl        nfsio
 66595  101610      0      0  3     0x14280  nfsidl        nfsio
 36143   76728      0      0  3     0x14280  nfsidl        nfsio
 99134  298218      0      0  3     0x14280  nfsidl        nfsio
  1476  106209      0      0  3     0x14280  nfsidl        nfsio
 51622  193460      0      0  3     0x14280  nfsidl        nfsio
  8119   83995      0      0  3     0x14280  nfsidl        nfsio
 64100  329909  87237      0  3        0x82  nanoslp       syz-executor
 60604  346436      0      0  3     0x14280  nfsidl        nfsio
 98038  136195      0      0  3     0x14280  nfsidl        nfsio
 13284  520012      0      0  3     0x14280  nfsidl        nfsio
 77028  501353      0      0  3     0x14280  nfsidl        nfsio
 22955  357135  87237      0  2         0x2                syz-executor
 98826   48569  87237      0  2       0xc82                syz-executor
 90731   40238  87237      0  2       0xc82                syz-executor
 23166  447532  87237      0  2       0xc82                syz-executor
 93872  135601  87237      0  2       0xc82                syz-executor
 87237  156787  52058      0  3        0x82  kqread        syz-executor
 52058  523360  25879      0  3    0x10008a  sigsusp       ksh
 25879   89354  15106      0  3        0x98  kqread        sshd-session
 15106  423275  83097      0  3        0x92  kqread        sshd-session
 59863  110828      1      0  3    0x100083  ttyopn        getty
 83097  519050      1      0  3        0x88  kqread        sshd
 34825  129003  51864     74  3   0x1100092  bpf           pflogd
 51864  196938      1      0  3        0x80  sbwait        pflogd
 72993  315732  77082     73  3   0x1100090  kqread        syslogd
 77082  225471      1      0  3    0x100082  sbwait        syslogd
 74675  314332      1      0  3    0x100080  kqread        resolvd
 25122   67608   6360     77  3    0x100092  kqread        dhcpleased
 28085  325290   6360     77  3    0x100092  kqread        dhcpleased
  6360   94490      1      0  3        0x80  kqread        dhcpleased
 77909  184916      0      0  3     0x14200  bored         smr
 75263  190312      0      0  2     0x14200                zerothread
 26670   83525      0      0  3     0x14200  aiodoned      aiodoned
 21410  180050      0      0  3     0x14200  syncer        update
 84646  498700      0      0  3     0x14200  cleaner       cleaner
 53085   71138      0      0  3     0x14200  reaper        reaper
 98516  204476      0      0  3     0x14200  pgdaemon      pagedaemon
 73117  129016      0      0  3     0x14200  bored         viomb
 10637   75051      0      0  3  0x40014200  acpi0         acpi0
 69794  480336      0      0  7  0x40014200                idle1
 19014  340610      0      0  3     0x14200  bored         softnet1
 42163  132542      0      0  3     0x14200  bored         softnet0
 29104  356798      0      0  3     0x14200  bored         systqmp
 61440  168719      0      0  3     0x14200  bored         systq
 70507  346511      0      0  3     0x14200  tmoslp        softclockmp
 21978  311839      0      0  3  0x40014200  tmoslp        softclock
 19075  249328      0      0  3  0x40014200                idle0
     1  420819      0      0  3     0x80082  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 22955 (syz-executor) thread 0xffff80003c41e030 (357135)
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10245  11044K   12600K 166960K     14005        0
            pcb    17     15K      16K 166960K       234        0
         rtable   240     12K      12K 166960K       648        0
             pf    41     18K      20K 166960K       197        0
         ifaddr    43      8K       8K 166960K       140        0
        ifgroup    64      2K       3K 166960K       241        0
         sysctl     4      1K       9K 166960K        17        0
       counters    72     37K      38K 166960K       258        0
       ioctlops     0      0K       6K 166960K      1726        0
            iov     0      0K      32K 166960K       205        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1466     92K      93K 166960K      2678        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K         3        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K        41        0
        dirhash    12      2K       2K 166960K        30        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    16     57K     240K 166960K      1221        0
          sigio     1      0K       0K 166960K        65        0
           proc    72    115K     164K 166960K       711        0
        subproc    72      4K       4K 166960K       111        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       123        0
       in_multi    87      6K       7K 166960K       188        0
    ether_multi     1      0K       0K 166960K         8        0
            mrt     0      0K       0K 166960K        11        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   235   1049K    1049K 166960K       235        0
           exec     0      0K       1K 166960K       546        0
   fusefs mount     1     32K      32K 166960K         1        0
     pfkey data     0      0K       0K 166960K         3        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   238    167K     191K 166960K     12996        0
       UVM aobj    31     10K      10K 166960K        33        0
     pinsyscall    42     84K     106K 166960K      2501        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        67        0
            NDP    14      0K       2K 166960K        97        0
           temp    72   8671K    8919K 166960K     58379        0
         kqueue    13     20K      36K 166960K       269        0
      SYN cache     2     16K      16K 166960K         2        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      124    0      121     1     0     1     1     0     8    0
rtentry    176      194    0      102     6     0     6     6     0     8    0
unpcb      144      499    0      480     2     1     1     2     0     8    0
syncache   336       12    0       12     2     1     1     1     0     8    1
tcpqe       32        4    0        4     2     1     1     1     0     8    1
tcpcb      736      533    0      524     9     5     4     7     0     8    3
arp        136       29    0       14     1     0     1     1     0     8    0
inpcb      328     1486    0     1473    15     7     8    13     0     8    6
nd6        152       40    0       15     1     0     1     1     0     8    0
pkpcb       40       10    0       10     1     1     0     1     0     8    0
kcovpl      48       12    0        4     1     0     1     1     0     8    0
ppxss      1192      71    0       71     1     0     1     1     0     8    1
pppxif     1504      11    0       11     2     1     1     1     0     8    1
pffrag     232       11    0        1     1     0     1     1     0   482    0
pffrnode    88        9    0        0     1     0     1     1     0     8    0
pffrent     40       13    0        3     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pfrktable  1344       2    0        2     1     1     0     1     0     8    0
pfstitem    24       68    0       22     1     0     1     1     0     8    0
pfstkey    128       68    0       22     2     0     2     2     0     8    0
pfstate    448       66    0       22     6     0     6     6     0     8    0
pfrule     1344      26    0       21     2     1     1     2     0     8    0
rttmr      136        3    0        3     3     2     1     1     0     8    1
art_heap8  4096       5    0        2     5     0     5     5     0     8    2
art_heap4  256      873    0      483    31     6    25    29     0     8    0
art_table   40      878    0      485     5     0     5     5     0     8    0
art_node    32      192    0      111     1     0     1     1     0     8    0
sysvmsgpl   40       14    0        8     1     0     1     1     0     8    0
semupl     112        1    0        1     1     1     0     1     0     8    0
semapl     112       34    0       24     1     0     1     1     0     8    0
shmpl      112       25    0        1     1     0     1     1     0     8    0
dirhash    1024      30    0       13     3     0     3     3     0     8    0
dino2pl    256     3639    0     2119    96     0    96    96     0     8    0
ffsino     296     3639    0     2119   118     0   118   118     0     8    0
ffsino: pool(0xffffffff839c3f10:ffsino): page inconsistency: page 0x0; at page head addr 0xfffffd806ca9af90 (p 0xfffffd806ca9a000)
nchpl      144     5214    0     3500    64     0    64    64     0     8    0
rtmask      32       11    0       11     2     1     1     1     0     8    1
vnodes     216     4554    0        0   253     0   253   253     0     8    0
namei      1024   19024    0    19023     2     1     1     2     0     8    0
percpumem   16      144    0       93     1     0     1     1     0     8    0
vcpupl     3968       5    0        1     1     0     1     1     0     8    0
vmpool     840        5    0        1     1     0     1     1     0     8    0
kstatmem   264      152    0      118     3     0     3     3     0     8    0
acpiwqpl    32        1    0        1     1     0     1     1     1     8    1
scsiplug    72        4    0        4     3     3     0     1     0     8    0
scxspl     216    21377    0    21377     9     8     1     8     1     8    1
plimitpl   152      239    0      221     1     0     1     1     0     8    0
sigapl     424     1552    0     1486     8     0     8     8     0     8    0
knotepl    120      343    0        0    11     0    11    11     0     8    0
kqueuepl   224      579    0      568     9     5     4     5     0     8    2
pipepl     344      377    0      350    15     6     9     9     0     8    6
fdescpl    528     1508    0     1478     3     0     3     3     0     8    0
filepl     160    10125    0     9905    21     4    17    18     0     8    5
lockfpl    104      532    0      530     1     0     1     1     0     8    0
lockfspl    48      212    0      210     1     0     1     1     0     8    0
sessionpl  144       33    0       24     1     0     1     1     0     8    0
pgrppl      48       66    0       48     1     0     1     1     0     8    0
ucredpl    104     1522    0     1506     1     0     1     1     0     8    0
zombiepl   144     1489    0     1486     1     0     1     1     0     8    0
processpl  1232    1552    0     1486     6     0     6     6     0     8    0
procpl     664     3236    0     3166     9     1     8     8     0     8    0
sosppl     176        5    0        5     2     2     0     1     0     8    0
sockpl     752     2143    0     2108    20     9    11    18     0     8    6
mcl64k     65536      5    0        0     1     0     1     1     0     8    0
mcl12k     12288      1    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       3    0        0     1     0     1     1     0     8    0
mcl4k      4096     112    0        0    14     0    14    14     0     8    0
mcl2k2     2112       2    0        0     1     0     1     1     0     8    0
mcl2k      2048      32    0        0     4     0     4     4     0     8    0
mtagpl      96       77    0        0     2     0     2     2     0     8    0
mbufpl     256      930    0        0    59     0    59    59     0     8    0
bufpl      280     7345    0     1208   439     0   439   439     0     8    0
anonpl      32     9712    0        0    79     0    79    79     0   246    0
amapchunkpl 152   44027    0    43555    39     4    35    35     0   158   11
amappl16   200     4522    0     4491    30    16    14    15     0     8    8
amappl15   192        5    0        5     2     2     0     1     0     8    0
amappl14   184        5    0        5     2     2     0     1     0     8    0
amappl13   176      484    0      483     1     0     1     1     0     8    0
amappl12   168     1945    0     1904     3     0     3     3     0     8    0
amappl11   160       45    0       45     1     1     0     1     0     8    0
amappl10   152       55    0       41     1     0     1     1     0     8    0
amappl9    144      274    0      274     1     1     0     1     0     8    0
amappl8    136       27    0       25     1     0     1     1     0     8    0
amappl7    128      100    0       99     1     0     1     1     0     8    0
amappl6    120      339    0      326     1     0     1     1     0     8    0
amappl5    112       88    0       77     1     0     1     1     0     8    0
amappl4    104      505    0      477     1     0     1     1     0     8    0
amappl3     96     7309    0     7219     4     1     3     3     0     8    0
amappl2     88     1667    0     1590     2     0     2     2     0     8    0
amappl1     80    15812    0    15220    14     0    14    14     0     8    0
amappl      88    11942    0    11782     5     0     5     5     0    92    0
uvmvnodes   80      141    0        0     3     0     3     3     0     8    0
dma4096    4096       2    0        2     2     2     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        6    0        6     1     1     0     1     0     8    0
dma128     128      255    0      255     3     3     0     1     0     8    0
dma64       64        6    0        6     1     1     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       32    0        2     1     0     1     1     0     8    0
uaddrrnd    24     1508    0     1477     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1508    0     1477     1     0     1     1     0     8    0
vmmpekpl   168    14428    0    14384     3     0     3     3     0     8    0
vmmpepl    168   102571    0   100667   106     8    98    98     0   357    8
vmsppl     488     1507    0     1477     5     0     5     5     0     8    0
rwobjpl     80    29315    0    28223    28     0    28    28     0     8    0
pdppl      4096    3033    0     2960   112    36    76    87     0     8    3
pvpl        32    18120    0        0   147     1   146   146     0   265    0
pmappl     256     1512    0     1478     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      352    0       52     9     0     9     9     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
ffs_write(ffff80003c480dd0) at ffs_write+0x170 sys/ufs/ffs/ffs_vnops.c:307
VOP_WRITE(fffffd8061fda6c0,ffff80003c480e68,23,fffffd80097fd000) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_rdwr(1,fffffd8061fda6c0,ffff80003c480fa0,40,0,1,8ff0e703785b9fa4,0,1018,0) at vn_rdwr+0x12d sys/kern/vfs_vnops.c:324
acct_process(ffff8000fffef240) at acct_process+0x7a2 sys/kern/kern_acct.c:245
exit1(ffff8000fffef240,0,0,1) at exit1+0x5c4 sys/kern/kern_exit.c:228
sys_exit(ffff8000fffef240,ffff80003c4811e0,ffff80003c481130) at sys_exit+0x1a sys/kern/kern_exit.c:-1
syscall(ffff80003c4811e0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c4811e0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:765
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7b3fbc9a7540, count: -8
ddb{0}> machine ddbcpu 1
Stopped at      x86_ipi_db+0x27:        addq    $0x8,%rsp
x86_ipi_db(ffff8000299edff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff8000299edff0) at sched_idle+0x391 sys/kern/kern_sched.c:191
end trace frame: 0x0, count: 10
ddb{1}> trace
x86_ipi_db(ffff8000299edff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394
x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27
acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224
sched_idle(ffff8000299edff0) at sched_idle+0x391 sys/kern/kern_sched.c:191
end trace frame: 0x0, count: -5

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/15 15:29 openbsd 56163c0cd41e f7988ea4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs_write
* Struck through repros no longer work on HEAD.