syzbot


uvm_fault: ffs_alloccg (2)

Status: upstream: reported on 2025/09/13 10:15
Reported-by: syzbot+e23b0003def272c61ad9@syzkaller.appspotmail.com
First crash: 2d01h, last: 1d23h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs_alloccg -1 1 366d 366d 0/3 auto-obsoleted due to no activity on 2024/12/13 05:49

Sample crash report:
uvm_fault(0xffffffff838fce98, 0xffff800028ba2004, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs_alloccg+0x16e:      movl    0x4(%r14),%r15d
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
* 35526  28448      0           0  0x4000000    0  syz-executor
 485004  50072      0           0  0x4000000    1K syz-executor
ffs_alloccg(fffffd806e9d6190,4,660e5,4000) at ffs_alloccg+0x16e ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_alloccg(fffffd806e9d6190,4,660e5,4000) at ffs_alloccg+0x16e sys/ufs/ffs/ffs_alloc.c:948
ffs_alloc(fffffd806e9d6190,0,660e5,4000,fffffd80097fb4e0,ffff80003c48b8e8) at ffs_alloc+0x314 ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:-1 [inline]
ffs_alloc(fffffd806e9d6190,0,660e5,4000,fffffd80097fb4e0,ffff80003c48b8e8) at ffs_alloc+0x314 sys/ufs/ffs/ffs_alloc.c:140
ffs2_balloc(fffffd806e9d6190,0,4000,fffffd80097fb4e0,2,ffff80003c48b9e8) at ffs2_balloc+0x7d3 sys/ufs/ffs/ffs_balloc.c:533
ffs_write(ffff80003c48ba70) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd80683c2e98,ffff80003c48bc28,7,fffffd80097fb4e0) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806b23ba48,ffff80003c48bc28,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:408
dofilewritev(ffff800039c00d28,3,ffff80003c48bc28,0,ffff80003c48bce0) at dofilewritev+0x242 sys/kern/sys_generic.c:380
sys_write(ffff800039c00d28,ffff80003c48bd90,ffff80003c48bce0) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80003c48bd90) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c48bd90) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:746
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3616f9a8210, count: 5
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{0}> 
ddb{0}> set $lines = 0
ddb{0}> set $maxwidth = 0
ddb{0}> show panic
*cpu0: uvm_fault(0xffffffff838fce98, 0xffff800028ba2004, 0, 1) -> d
ddb{0}> trace
ffs_alloccg(fffffd806e9d6190,4,660e5,4000) at ffs_alloccg+0x16e ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_alloccg(fffffd806e9d6190,4,660e5,4000) at ffs_alloccg+0x16e sys/ufs/ffs/ffs_alloc.c:948
ffs_alloc(fffffd806e9d6190,0,660e5,4000,fffffd80097fb4e0,ffff80003c48b8e8) at ffs_alloc+0x314 ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:-1 [inline]
ffs_alloc(fffffd806e9d6190,0,660e5,4000,fffffd80097fb4e0,ffff80003c48b8e8) at ffs_alloc+0x314 sys/ufs/ffs/ffs_alloc.c:140
ffs2_balloc(fffffd806e9d6190,0,4000,fffffd80097fb4e0,2,ffff80003c48b9e8) at ffs2_balloc+0x7d3 sys/ufs/ffs/ffs_balloc.c:533
ffs_write(ffff80003c48ba70) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd80683c2e98,ffff80003c48bc28,7,fffffd80097fb4e0) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806b23ba48,ffff80003c48bc28,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:408
dofilewritev(ffff800039c00d28,3,ffff80003c48bc28,0,ffff80003c48bce0) at dofilewritev+0x242 sys/kern/sys_generic.c:380
sys_write(ffff800039c00d28,ffff80003c48bd90,ffff80003c48bce0) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80003c48bd90) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c48bd90) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:746
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3616f9a8210, count: -10
ddb{0}> show registers
rdi                                0
rsi                                0
rbp               0xffff80003c48b750
rbx               0xfffffd806e9d6190
rdx               0xffff80000144f980
rcx               0xffff800039c00d28
rax               0xffffffff83799ff0    cpu_info_full_primary+0x1ff0
r8                0xffffffffffffffff
r9                0xffff80003c48b8e8
r10                                0
r11               0xc5dd772e27053908
r12                           0x4000    __ALIGN_SIZE+0x3000
r13               0xfffffd805ce4d6c0
r14               0xffff800028ba2000
r15                                0
rip               0xffffffff8132fb9e    ffs_alloccg+0x16e
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80003c48b6a0
ss                              0x10
ffs_alloccg+0x16e:      movl    0x4(%r14),%r15d
ddb{0}> show proc
PROC (syz-executor) tid=35526 pid=28448 tcnt=2 stat=onproc
    flags process=0 proc=4000000<THREAD>
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff800039c00560,0xffffffff838fabc8
    process=0xffff80002a3cc9b8 user=0xffff80003c486000, vmspace=0xfffffd805cacaba0
    estcpu=36, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0
ddb{0}> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 28448  194531  77318      0  2           0                syz-executor
*28448   35526  77318      0  7   0x4000000                syz-executor
 72081  102032  38031  60929  3        0x90  nanoslp       syz-executor
 72081   81502  38031  60929  3   0x4000090  sysctllk      syz-executor
 38109  494935  68211      0  3        0x82  sysctllk      syz-executor
 29609  212927  68211      0  3        0x82  sysctllk      syz-executor
   611   44843  68211      0  3        0x82  sysctllk      syz-executor
 31895  181145  68211      0  3        0x82  sysctllk      syz-executor
 59631  107635  68211      0  3        0x82  sysctllk      syz-executor
 84339  416019   8733      0  3        0x82  sysctllk      sshd-session
 50072    6077      1      0  3           0  vmmapbsy      syz-executor
 50072  510087      1      0  3   0x4000000  vmmapbsy      syz-executor
 50072  485004      1      0  7   0x4000000                syz-executor
 50072  427171      1      0  3   0x4000000  vmmapbsy      syz-executor
 56858  325351      0      0  3     0x14200  bored         sosplice
 77318    1990  68211      0  2       0xc82                syz-executor
 38031   14834  68211      0  3        0x82  nanoslp       syz-executor
 95165   80183  68211      0  3        0x82  nanoslp       syz-executor
 68211  481005  89855      0  3        0x82  kqread        syz-executor
 89855  404782  57485      0  3    0x10008a  sigsusp       ksh
 57485  490102  24787      0  3        0x98  kqread        sshd-session
 24787   59213   8733      0  3        0x92  kqread        sshd-session
 12941  395266      1      0  3    0x100083  ttyin         getty
  8733  252381      1      0  3        0x88  kqread        sshd
 54402  141303  15455     74  3   0x1100092  bpf           pflogd
 15455  170959      1      0  3        0x80  sbwait        pflogd
 15367  277784  48530     73  3   0x1100090  kqread        syslogd
 48530  142987      1      0  3    0x100082  sbwait        syslogd
 18580   19371      1      0  3    0x100080  kqread        resolvd
 79113  280669  84745     77  3    0x100092  sysctllk      dhcpleased
 69893   57445  84745     77  3    0x100092  kqread        dhcpleased
 84745   51192      1      0  3        0x80  kqread        dhcpleased
 27052   34473      0      0  3     0x14200  bored         smr
 16427  290297      0      0  3     0x14200  pgzero        zerothread
 52790  182723      0      0  3     0x14200  aiodoned      aiodoned
 40090  449815      0      0  3     0x14200  syncer        update
 25792  371078      0      0  3     0x14200  cleaner       cleaner
 13074  513827      0      0  3     0x14200  reaper        reaper
 86852  178444      0      0  3     0x14200  pgdaemon      pagedaemon
 50114  150249      0      0  3     0x14200  bored         viomb
  8443   25961      0      0  3  0x40014200  acpi0         acpi0
 86632  222838      0      0  3  0x40014200                idle1
 88366   68414      0      0  3     0x14200  bored         softnet1
 34545   91328      0      0  3     0x14200  bored         softnet0
 89481   85565      0      0  3     0x14200  bored         systqmp
 49236  104007      0      0  3     0x14200  bored         systq
 13518  443319      0      0  3     0x14200  tmoslp        softclockmp
  7383  142267      0      0  3  0x40014200  tmoslp        softclock
 72299  381956      0      0  3  0x40014200                idle0
     1  106698      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb{0}> show all locks
Process 28448 (syz-executor) thread 0xffff800039c00d28 (35526)
exclusive rrwlock inode r = 0 (0xfffffd806e9d6230)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xa3 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x18f sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x242 sys/kern/sys_generic.c:380
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:746
#9  Xsyscall+0x128
exclusive kernel_lock &kernel_lock r = 0 (0xffffffff838f9630)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  vn_write+0x4e sys/kern/vfs_vnops.c:393
#2  dofilewritev+0x242 sys/kern/sys_generic.c:380
#3  sys_write+0xa2 sys/kern/sys_generic.c:300
#4  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#4  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:746
#5  Xsyscall+0x128
Process 50072 (syz-executor) thread 0xffff80003bc09778 (510087)
exclusive rrwlock inode r = 0 (0xfffffd806e32fdd0)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  rrw_enter+0xc6 sys/kern/kern_rwlock.c:621
#3  VOP_LOCK+0xa3 sys/kern/vfs_vops.c:527
#4  vn_lock+0xa4 sys/kern/vfs_vnops.c:570
#5  vn_write+0x18f sys/kern/vfs_vnops.c:405
#6  dofilewritev+0x242 sys/kern/sys_generic.c:380
#7  sys_write+0xa2 sys/kern/sys_generic.c:300
#8  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#8  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:746
#9  Xsyscall+0x128
Process 50072 (syz-executor) thread 0xffff80003bc08550 (485004)
exclusive rwlock sysctllk r = 0 (0xffffffff837d3698)
#0  witness_lock+0x5f1 stacktrace_save sys/sys/stacktrace.h:37 [inline]
#0  witness_lock+0x5f1 sys/kern/subr_witness.c:1160
#1  rw_do_enter_write+0x419 sys/kern/kern_rwlock.c:320
#2  sysctl_vslock+0x45 sys/kern/kern_sysctl.c:191
#3  kern_sysctl_dirs+0x243 sys/kern/kern_sysctl.c:440
#4  kern_sysctl+0x139 sys/kern/kern_sysctl.c:733
#5  sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
#6  syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
#6  syscall+0xbd4 sys/arch/amd64/amd64/trap.c:746
#7  Xsyscall+0x128
ddb{0}> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 10226  11102K   11498K 166960K     13379        0
            pcb    17     12K      12K 166960K       235        0
         rtable   146      7K       7K 166960K       460        0
             pf    31     17K      82K 166960K       159        0
         ifaddr    26      4K       8K 166960K        99        0
        ifgroup    39      1K       2K 166960K       175        0
         sysctl     1      1K       9K 166960K        11        0
       counters    60     35K      37K 166960K       192        0
       ioctlops     0      0K       4K 166960K      1757        0
            iov     0      0K      16K 166960K       120        0
          mount     1      1K       1K 166960K         1        0
            log     0      0K       0K 166960K         4        0
         vnodes  1424     90K      90K 166960K      2842        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     3      5K       9K 166960K        23        0
         VM map     2      1K       1K 166960K         2        0
            sem    12      0K       0K 166960K       132        0
        dirhash    12      2K       2K 166960K        27        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    14     34K     350K 166960K      1538        0
          sigio     0      0K       0K 166960K        38        0
           proc    72    115K     164K 166960K       706        0
        subproc    36      2K       4K 166960K        73        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     0      0K       0K 166960K       185        0
       in_multi    51      3K       7K 166960K       150        0
    ether_multi     1      0K       0K 166960K        13        0
            mrt     1      0K       0K 166960K        10        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
           ttys   259   1155K    1155K 166960K       259        0
           exec     0      0K       1K 166960K       624        0
   fusefs mount     1     32K      32K 166960K         1        0
            tdb     3      0K       0K 166960K         3        0
        VM swap     8     62K      64K 166960K        10        0
       UVM amap   204    128K     174K 166960K     16593        0
       UVM aobj    35      2K       2K 166960K        42        0
     pinsyscall    41     82K     110K 166960K      2617        0
        memdesc     1      4K       4K 166960K         1        0
    crypto data     1      1K       1K 166960K         1        0
    ip6_options     0      0K       0K 166960K        82        0
            NDP     8      0K       2K 166960K        73        0
           temp    63   8651K    8776K 166960K     75959        0
         kqueue    13     20K      29K 166960K       325        0
      SYN cache     2      8K      16K 166960K         3        0
ddb{0}> show all pools
Name      Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle
plcache    128       26    0        0     1     0     1     1     0     8    0
rtpcb      120      176    0      173     2     1     1     2     0     8    0
rtentry    176      119    0       65     5     0     5     5     0     8    0
unpcb      144     1140    0     1121    12     6     6     6     0     8    5
syncache   336        5    0        5     3     3     0     1     0     8    0
sackhl      24        1    0        1     1     1     0     1     0     8    0
tcpcb      736      541    0      535    19    18     1     7     0     8    0
arp        136       12    0        4     1     0     1     1     0     8    0
inpcb      328     1493    0     1483    24    17     7     7     0     8    5
nd6        144       21    0       11     1     0     1     1     0     8    0
pkpcb       40       16    0       16     3     2     1     1     0     8    1
kcovpl      48        8    0        4     1     0     1     1     0     8    0
ppxss      1192      52    0       52     4     3     1     1     0     8    1
pppxif     1504       5    0        5     4     4     0     1     0     8    0
pfstscr     40        6    0        5     5     4     1     1     0     8    0
pffrag     232       15    0        5     1     0     1     1     0   482    0
pffrnode    88       13    0        4     1     0     1     1     0     8    0
pffrent     40       39    0       29     1     0     1     1     0     8    0
pfosfp      40     1428    0     1005     5     0     5     5     0     8    0
pfosfpen   112     1428    0      714    21     0    21    21     0     8    0
pftag       88        2    0        1     2     1     1     1     0     8    0
pfstitem    24       96    0       63     1     0     1     1     0     8    0
pfstkey    128      104    0       71     2     0     2     2     0     8    0
pfstate    384      100    0       69     6     0     6     6     0     8    0
pfrule     1344      27    0       21     2     1     1     2     0     8    0
rttmr      136        2    0        2     2     1     1     1     0     8    1
art_heap8  4096       4    0        0     4     0     4     4     0     8    0
art_heap4  256      616    0      379    28     9    19    28     0     8    0
art_table   40      620    0      379     5     0     5     5     0     8    0
art_node    32      118    0       72     1     0     1     1     0     8    0
sysvmsgpl   40       51    0       13     1     0     1     1     0     8    0
semapl     112      125    0      115     1     0     1     1     0     8    0
shmpl      112       39    0        7     1     0     1     1     0     8    0
dirhash    1024      27    0       10     3     0     3     3     0     8    0
dino2pl    256     4525    0     3021    96     1    95    96     0     8    0
ffsino     296     4525    0     3021   117     0   117   117     0     8    0
nchpl      144     6641    0     4943    64     0    64    64     0     8    0
rtmask      32        5    0        5     3     3     0     1     0     8    0
uvmvnodes   80     5296    0        0   109     0   109   109     0     8    0
vnodes     216     5296    0        0   295     0   295   295     0     8    0
namei      1024   23327    0    23327     5     4     1     3     0     8    1
percpumem   16      111    0       66     1     0     1     1     0     8    0
kstatmem   264      116    0       98     4     2     2     3     0     8    0
scsiplug    72       12    0       12     6     5     1     1     0     8    1
scxspl     216    35247    0    35247    12    11     1     8     1     8    1
plimitpl   152      358    0      340     1     0     1     1     0     8    0
sigapl     424     1814    0     1768     7     1     6     7     0     8    0
knotepl    120      552    0        0    16     0    16    16     0     8    0
kqueuepl   224      788    0      778    11    10     1     5     0     8    0
pipepl     344      263    0      235     3     0     3     3     0     8    0
fdescpl    528     1790    0     1761     3     0     3     3     0     8    0
filepl     160    12780    0    12598    27    13    14    15     0     8    3
lockfpl    104      770    0      768     2     1     1     2     0     8    0
lockfspl    48      277    0      275     1     0     1     1     0     8    0
sessionpl  144       24    0       14     1     0     1     1     0     8    0
pgrppl      48       59    0       40     1     0     1     1     0     8    0
ucredpl    104     2599    0     2585     1     0     1     1     0     8    0
zombiepl   144     2728    0     2727     1     0     1     1     0     8    0
processpl  1232    1814    0     1768     5     1     4     5     0     8    0
procpl     664     4577    0     4526     7     0     7     7     0     8    0
sosppl     168        9    0        9     5     4     1     1     0     8    1
sockpl     752     2926    0     2894    34    22    12    17     0     8    8
mcl64k     65536      6    0        0     1     0     1     1     0     8    0
mcl12k     12288      3    0        0     1     0     1     1     0     8    0
mcl9k      9216       1    0        0     1     0     1     1     0     8    0
mcl8k      8192       7    0        0     1     0     1     1     0     8    0
mcl4k      4096     120    0        0    15     0    15    15     0     8    0
mcl2k      2048      58    0        0     6     0     6     6     0     8    0
mtagpl      96       10    0        0     1     0     1     1     0     8    0
mbufpl     256     1228    0        0    77     0    77    77     0     8    0
bufpl      280    14809    0     8666   440     0   440   440     0     8    0
anonpl      32    11980    0        0    98     1    97    97     0   246    0
amapchunkpl 152   57863    0    57507    57    30    27    32     0   158    9
amappl16   200     5677    0     5649    75    61    14    28     0     8    8
amappl15   192        8    0        8     1     1     0     1     0     8    0
amappl14   184      117    0      104     1     0     1     1     0     8    0
amappl13   176        3    0        3     1     1     0     1     0     8    0
amappl12   168     2437    0     2414     3     1     2     2     0     8    0
amappl11   160       54    0       40     1     0     1     1     0     8    0
amappl10   152        4    0        3     1     0     1     1     0     8    0
amappl9    144      258    0      258     1     1     0     1     0     8    0
amappl8    136       20    0       18     1     0     1     1     0     8    0
amappl7    128      125    0      111     1     0     1     1     0     8    0
amappl6    120      181    0      176     1     0     1     1     0     8    0
amappl5    112      121    0      110     1     0     1     1     0     8    0
amappl4    104      296    0      275     1     0     1     1     0     8    0
amappl3     96     9855    0     9786     4     0     4     4     0     8    0
amappl2     88     2043    0     1962     2     0     2     2     0     8    0
amappl1     80    14107    0    13486    18     4    14    16     0     8    0
amappl      88    15760    0    15633     5     0     5     5     0    92    0
dma65536   65536      1    0        1     1     1     0     1     0     8    0
dma4096    4096       1    0        1     1     1     0     1     0     8    0
dma2048    2048       1    0        1     1     1     0     1     0     8    0
dma1024    1024       1    0        0     1     0     1     1     0     8    0
dma256     256        7    0        7     2     2     0     1     0     8    0
dma128     128      259    0      259     5     5     0     1     0     8    0
dma64       64        9    0        9     3     3     0     1     0     8    0
dma32       32        7    0        7     1     1     0     1     0     8    0
dma16       16       18    0       17     1     0     1     1     0     8    0
aobjpl      72       41    0        7     1     0     1     1     0     8    0
uaddrrnd    24     1790    0     1761     1     0     1     1     0     8    0
uaddrbest   32        2    0        0     1     0     1     1     0     8    0
uaddr       24     1790    0     1761     1     0     1     1     0     8    0
vmmpekpl   168    15375    0    15317     4     1     3     4     0     8    0
vmmpepl    168   117571    0   115795   130    32    98   114     0   357    6
vmsppl     488     1789    0     1761     7     2     5     5     0     8    0
rwobjpl     80    37721    0    31475   137     2   135   135     0     8    3
pdppl      4096    3588    0     3522   108    42    66    88     0     8    0
pvpl        32    19254    0        0   156     1   155   155     0   265    0
pmappl     256     1789    0     1761     3     0     3     3     0     8    0
extentpl    40       45    0       27     1     0     1     1     0     8    0
phpool     112      375    0       82     9     0     9     9     0     8    0
ddb{0}> machine ddbcpu 0
Invalid cpu 0
ddb{0}> trace
ffs_alloccg(fffffd806e9d6190,4,660e5,4000) at ffs_alloccg+0x16e ffs_cgread sys/ufs/ffs/ffs_alloc.c:856 [inline]
ffs_alloccg(fffffd806e9d6190,4,660e5,4000) at ffs_alloccg+0x16e sys/ufs/ffs/ffs_alloc.c:948
ffs_alloc(fffffd806e9d6190,0,660e5,4000,fffffd80097fb4e0,ffff80003c48b8e8) at ffs_alloc+0x314 ffs_hashalloc sys/ufs/ffs/ffs_alloc.c:-1 [inline]
ffs_alloc(fffffd806e9d6190,0,660e5,4000,fffffd80097fb4e0,ffff80003c48b8e8) at ffs_alloc+0x314 sys/ufs/ffs/ffs_alloc.c:140
ffs2_balloc(fffffd806e9d6190,0,4000,fffffd80097fb4e0,2,ffff80003c48b9e8) at ffs2_balloc+0x7d3 sys/ufs/ffs/ffs_balloc.c:533
ffs_write(ffff80003c48ba70) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd80683c2e98,ffff80003c48bc28,7,fffffd80097fb4e0) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806b23ba48,ffff80003c48bc28,0) at vn_write+0x1d3 sys/kern/vfs_vnops.c:408
dofilewritev(ffff800039c00d28,3,ffff80003c48bc28,0,ffff80003c48bce0) at dofilewritev+0x242 sys/kern/sys_generic.c:380
sys_write(ffff800039c00d28,ffff80003c48bd90,ffff80003c48bce0) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80003c48bd90) at syscall+0xbd4 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003c48bd90) at syscall+0xbd4 sys/arch/amd64/amd64/trap.c:746
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x3616f9a8210, count: -10
ddb{0}> machine ddbcpu 1

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/13 12:14 openbsd 597bb1fc1f2a e2beed91 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs_alloccg
2025/09/13 10:14 openbsd 597bb1fc1f2a e2beed91 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs_alloccg
* Struck through repros no longer work on HEAD.