uvm_fault: ufs_readdir

Status: upstream: reported on 2026/05/26 22:30
Reported-by: syzbot+f60de315eda5f53c0057@syzkaller.appspotmail.com
First crash: 115d, last: 39d

Sample crash report:
uvm_fault(0xffffffff839bc2a8, 0xffff8000280b2004, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ufs_readdir+0x26e:      movzwl  0x4(%r14),%ebx
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*183710  82069      0         0x2          0    0  syz-executor
ufs_readdir(ffff80002a869570) at ufs_readdir+0x26e sys/ufs/ufs/ufs_vnops.c:1397
VOP_READDIR(fffff10076cd21e8,ffff80002a8695f8,fffff10007ffd7b8,ffff80002a86963c) at VOP_READDIR+0x125 sys/kern/vfs_vops.c:453
sys_getdents(ffff80002a7362a0,ffff80002a869780,ffff80002a8696d0) at sys_getdents+0x2dd sys/kern/vfs_syscalls.c:3133
syscall(ffff80002a869780) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a869780) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78b821186730, count: 10
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff839bc2a8, 0xffff8000280b2004, 0, 1) -> d
ddb> show kasan
No such command
ddb> trace
ufs_readdir(ffff80002a869570) at ufs_readdir+0x26e sys/ufs/ufs/ufs_vnops.c:1397
VOP_READDIR(fffff10076cd21e8,ffff80002a8695f8,fffff10007ffd7b8,ffff80002a86963c) at VOP_READDIR+0x125 sys/kern/vfs_vops.c:453
sys_getdents(ffff80002a7362a0,ffff80002a869780,ffff80002a8696d0) at sys_getdents+0x2dd sys/kern/vfs_syscalls.c:3133
syscall(ffff80002a869780) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a869780) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x78b821186730, count: -5
ddb> show registers
rdi                            0x200
rsi                            0x800
rbp               0xffff80002a869560
rbx                            0x200
rdx                                0
rcx               0xfffff1007ed62378
rax               0xffff8000280b2200
r8                0xffffffffffffffff
r9                               0x2
r10               0x97ddafe5ed5cdead
r11               0xfc13b7a0867071a5
r12                                0
r13               0xffff80002a8695f8
r14               0xffff8000280b2000
r15               0xffff8000280b2008
rip               0xffffffff8137d93e    ufs_readdir+0x26e
cs                               0x8
rflags                       0x10283    __ALIGN_SIZE+0xf283
rsp               0xffff80002a8693b0
ss                              0x10
ufs_readdir+0x26e:      movzwl  0x4(%r14),%ebx
ddb> show proc
PROC (syz-executor) tid=183710 pid=82069 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=0
    runpri=32, usrpri=50, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a736538,0xffff80002a7367e0
    process=0xffff80002a79cd90 user=0xffff80002a864000, vmspace=0xfffff1007f01f008
    estcpu=36, cpticks=6, pctcpu=0.1, user=0, sys=6, intr=0
ddb> ps
   PID     TID   PPID   UID  S      PRLAGS     PFLAGS WAIT      COMMAND
 70398  327911  19002     0  2           0      0xc80           syz-executor
 70398  306353  19002     0  2           0  0x4000000           syz-executor
 70398  370843  19002     0  3           0  0x4000080 fsleep    syz-executor
 51096  397667  37292 60928  2        0x10      0xc80           syz-executor
 51096  424719  37292 60928  3        0x10  0x4000080 ttyretype syz-executor
 51096   57976  37292 60928  3        0x10  0x4000080 fsleep    syz-executor
 66157  328128  75457     0  3           0       0x80 nanoslp   syz-executor
 66157  279685  75457     0  3           0  0x4000080 ttyout    syz-executor
 66157  394174  75457     0  3           0  0x4000080 fsleep    syz-executor
 45383  301488  88963     0  2           0      0xc80           syz-executor
 45383  517461  88963     0  3           0  0x4000080 msgwait   syz-executor
 45383   34986  88963     0  3           0  0x4000080 fsleep    syz-executor
 37292   84866  98441     0  3         0x2       0x80 nanoslp   syz-executor
 21295  272283      1     0  3           0       0x80 nanoslp   init
 91975    6110      0     0  3     0x14000      0x280 nfsidl    nfsio
 35189  287041      0     0  3     0x14000      0x280 nfsidl    nfsio
 64417   90960      0     0  3     0x14000      0x280 nfsidl    nfsio
 89057  186436      0     0  3     0x14000      0x280 nfsidl    nfsio
 40092  389661      0     0  3     0x14000      0x280 nfsidl    nfsio
 11995  242878      0     0  3     0x14000      0x280 nfsidl    nfsio
  4121   45927      0     0  3     0x14000      0x280 nfsidl    nfsio
 77938  232823      0     0  3     0x14000      0x280 nfsidl    nfsio
 84278   66556      0     0  3     0x14000      0x280 nfsidl    nfsio
 41538  317404      0     0  3     0x14000      0x280 nfsidl    nfsio
 46953  377704      0     0  3     0x14000      0x280 nfsidl    nfsio
 87073   32362      0     0  3     0x14000      0x280 nfsidl    nfsio
 45486  435635      0     0  3     0x14000      0x280 nfsidl    nfsio
 62914  148363      0     0  3     0x14000      0x280 nfsidl    nfsio
 32001  248806      0     0  3     0x14000      0x280 nfsidl    nfsio
 65168  383826      0     0  3     0x14000      0x280 nfsidl    nfsio
 38500  320585      0     0  3     0x14000      0x280 nfsidl    nfsio
 71895  322005      0     0  3     0x14000      0x280 nfsidl    nfsio
 80307  220224      0     0  3     0x14000      0x280 nfsidl    nfsio
 73924   66066      0     0  3     0x14000      0x280 nfsidl    nfsio
 75457  449037  98441     0  3         0x2       0x80 nanoslp   syz-executor
 97414  341230      0     0  3     0x14000      0x200 acct      acct
 54278  486933  98441     0  3         0x2       0x80 wait      syz-executor
*82069  183710  98441     0  7         0x2          0           syz-executor
 88963  302064  98441     0  2         0x2      0xc80           syz-executor
 19002  327320  98441     0  2         0x2      0xc80           syz-executor
 13318  452861  98441     0  3         0x2       0x80 wait      syz-executor
 98441  512356      1     0  3         0x2       0x80 wait      syz-executor
 55606   89403      0     0  3     0x14000      0x200 bored     smr
 47523  453035      0     0  2     0x14000      0x200           zerothread
 46982  370862      0     0  3     0x14000      0x200 aiodoned  aiodoned
 59560   82807      0     0  3     0x14000      0x200 syncer    update
 12485  214962      0     0  3     0x14000      0x200 cleaner   cleaner
 98000  217685      0     0  3     0x14000      0x200 reaper    reaper
 46014  519509      0     0  3     0x14000      0x200 pgdaemon  pagedaemon
 79873  497017      0     0  3     0x14000      0x200 bored     viomb
 28680  439632      0     0  3     0x14000 0x40000200 acpi0     acpi0
 97198  120409      0     0  3     0x14000      0x200 bored     softnet0
 31584  244645      0     0  3     0x14000      0x200 bored     systqmp
 43589  437343      0     0  3     0x14000      0x200 bored     systq
 29855  431306      0     0  3     0x14000 0x40000200 tmoslp    softclock
 24340  242603      0     0  3     0x14000 0x40000200           idle0
     1   29971      0     0  3         0x2       0x80 wait      init
     0       0     -1     0  3     0x10000      0x200 scheduler swapper
ddb> show all locks
No such command
ddb> show malloc
           Type InUse  MemUse  HighUse   Limit  Requests Type Lim
         devbuf 11041  12170K   12401K 166960K     13033        0
            pcb    18     13K      14K 166960K       270        0
         rtable   221      7K       9K 166960K       526        0
             pf    35     14K      20K 166960K       178        0
         ifaddr    41      7K       8K 166960K        85        0
        ifgroup    50      2K       2K 166960K       132        0
         sysctl     4      1K       9K 166960K        43        0
       counters    33     17K      18K 166960K        68        0
       ioctlops     0      0K       4K 166960K       361        0
            iov     1      0K      16K 166960K        45        0
          mount     1      1K       1K 166960K         1        0
            log     1      0K       0K 166960K         5        0
         vnodes  1391     87K      88K 166960K      2242        0
      UFS quota     1     32K      32K 166960K         1        0
      UFS mount     5     36K      36K 166960K         5        0
            shm     2      1K       5K 166960K        15        0
         VM map     2      1K       1K 166960K         2        0
            sem    23      3K       3K 166960K       101        0
        dirhash    12      2K       2K 166960K        21        0
           ACPI  1692    195K     286K 166960K     12470        0
      file desc    15     57K     236K 166960K       909        0
          sigio     0      0K       0K 166960K        12        0
           proc    11     17K      83K 166960K       675        0
        subproc    72      4K       4K 166960K        90        0
    NFS srvsock     1      0K       0K 166960K         1        0
     NFS daemon     1     16K      16K 166960K         1        0
    ip_moptions     1      0K       0K 166960K       129        0
       in_multi    95      6K       7K 166960K       145        0
    ether_multi     1      0K       0K 166960K         5        0
            mrt     0      0K       0K 166960K        22        0
    ISOFS mount     1     32K      32K 166960K         1        0
  MSDOSFS mount     1     16K      16K 166960K         1        0
          

Crashes (186):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/10 06:43 openbsd fab829404855 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/10 03:02 openbsd fab829404855 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/09 18:13 openbsd fab829404855 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/09 07:21 openbsd 350de6efe927 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/09 05:11 openbsd 350de6efe927 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/09 01:35 openbsd 3dc8f332bbde 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/08 11:39 openbsd d607cd596f17 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/08 08:21 openbsd d607cd596f17 5d63f80b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/08 00:25 openbsd 03dd4c68d240 e4ef95d6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/07 10:29 openbsd ea06ec21fb36 c38879ea .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/06 17:59 openbsd 07df0a216fc9 cc56899a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/06 15:03 openbsd 07df0a216fc9 cc56899a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/06 08:20 openbsd c0dbfd168cb4 cd5b1963 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/05 17:10 openbsd 544119925528 a424b13b .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/05 03:02 openbsd e4512c136ac0 52aa2820 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/04 11:48 openbsd f0a00c4e105c 3c5eaa21 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/04 05:06 openbsd 3ee0646fca13 9451e17e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/03 23:39 openbsd 3ee0646fca13 9451e17e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/03 17:14 openbsd 8bdaccf9d694 6b7c9f71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/03 16:03 openbsd 8bdaccf9d694 6b7c9f71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/03 02:08 openbsd 5a9a92b549ab e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/02 22:56 openbsd f8480ad0276a e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/02 18:52 openbsd f8480ad0276a e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/02 09:28 openbsd f8480ad0276a e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/02 03:32 openbsd f8480ad0276a e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/08/01 11:48 openbsd 59ec3ab4d107 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/31 22:51 openbsd ec875f0e6c74 e611ffe1 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/31 14:04 openbsd 6bf809100faf db462e94 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/31 10:34 openbsd 6bf809100faf db462e94 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/28 20:43 openbsd e63b2cdac76f 5fe7c56f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/28 16:28 openbsd e63b2cdac76f 5fe7c56f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/25 04:33 openbsd f3d8a5574675 492bab15 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/23 15:16 openbsd 6c9531571979 71a13572 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/23 09:36 openbsd 7df8bae8aea9 881ce5c2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/22 23:06 openbsd 7df8bae8aea9 881ce5c2 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/22 10:31 openbsd 9107f2bc3d03 4a865b71 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/21 16:34 openbsd 20200149c668 7c5de9c3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/20 22:32 openbsd d55fd7dd01df de6a700d .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/19 01:17 openbsd fc1b4e4caf7d 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/18 13:34 openbsd bc321d44d2f5 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/18 08:41 openbsd 97f4e10dc0be 72524a66 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/17 20:02 openbsd 94b919120046 7f27c57a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/17 12:13 openbsd 94b919120046 7f27c57a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/17 05:55 openbsd 5f0b8e1b9eb7 6ca2b51a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/15 11:47 openbsd af68cf7bb0f1 a4ed0f4f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/14 09:46 openbsd ddde2be8d3c6 2130f682 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/07/13 15:24 openbsd 663dfdac4969 a870962e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
2026/05/26 22:30 openbsd 51e8ce08d8c9 2b01f00e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ufs_readdir
* Struck through repros no longer work on HEAD.