syzbot


uvm_fault: ffs2_balloc (7)

Status: upstream: reported on 2026/03/27 02:05
Reported-by: syzbot+27c62742ccfde7447505@syzkaller.appspotmail.com
First crash: 94d, last: 4h34m
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) -1 3 1196d 1266d 0/3 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc (5) -1 4 442d 589d 0/3 auto-obsoleted due to no activity on 2025/07/12 07:43
openbsd uvm_fault: ffs2_balloc (6) -1 10 202d 289d 0/3 auto-obsoleted due to no activity on 2026/03/09 12:43
openbsd uvm_fault: ffs2_balloc -1 1 1565d 1565d 0/3 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) -1 5 787d 891d 0/3 auto-obsoleted due to no activity on 2024/07/31 16:15
openbsd uvm_fault: ffs2_balloc (4) -1 17 652d 663d 0/3 auto-obsoleted due to no activity on 2024/11/04 07:48

Sample crash report:
uvm_fault(0xffffffff83ab2910, 0xffff800027332158, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs2_balloc+0xa0a:      movq    0(%rcx,%rax,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*392358  24154      0         0x2        0x1    0  syz-executor
ffs2_balloc(fffff1006a0c1000,dd8b1,50,fffff10007ffd820,1,ffff80002a848da8) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a848e30) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffff10068a47020,ffff80002a848ee0,3,fffff10007ffd820) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a736008,fffff10068a47020,fffff10007ffd820,ffff80002a848fb0,ffff80002a848f90) at ktrwriteraw+0x19b sys/kern/kern_ktrace.c:692
ktrsysret(ffff80002a736008,5b,0,ffff80002a849070) at ktrsysret+0x17f ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80002a736008,5b,0,ffff80002a849070) at ktrsysret+0x17f sys/kern/kern_ktrace.c:209
syscall(ffff80002a849120) at syscall+0xad9 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80002a849120) at syscall+0xad9 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6fe9bd6a6300, count: 8
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83ab2910, 0xffff800027332158, 0, 1) -> d
ddb> trace
ffs2_balloc(fffff1006a0c1000,dd8b1,50,fffff10007ffd820,1,ffff80002a848da8) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a848e30) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffff10068a47020,ffff80002a848ee0,3,fffff10007ffd820) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
ktrwriteraw(ffff80002a736008,fffff10068a47020,fffff10007ffd820,ffff80002a848fb0,ffff80002a848f90) at ktrwriteraw+0x19b sys/kern/kern_ktrace.c:692
ktrsysret(ffff80002a736008,5b,0,ffff80002a849070) at ktrsysret+0x17f ktrwrite2 sys/kern/kern_ktrace.c:-1 [inline]
ktrsysret(ffff80002a736008,5b,0,ffff80002a849070) at ktrsysret+0x17f sys/kern/kern_ktrace.c:209
syscall(ffff80002a849120) at syscall+0xad9 mi_syscall_return sys/sys/syscall_mi.h:204 [inline]
syscall(ffff80002a849120) at syscall+0xad9 sys/arch/amd64/amd64/trap.c:804
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x6fe9bd6a6300, count: -7
ddb> show registers
rdi                                0
rsi                                0
rbp               0xffff80002a848d50
rbx               0xfffff1006a0c1000
rdx                                0
rcx               0xffff800027332000
rax                             0x2b
r8                0xffffffffffffffff
r9                0xffff80002a848da8
r10               0xd0ad94226a08b591
r11               0x9d3d072bbe58e6a1
r12                              0x1
r13               0xffff800000c48800
r14               0xffff80002a848bf0
r15               0xfffff1005e1bdcc8
rip               0xffffffff81b9ecba    ffs2_balloc+0xa0a
cs                               0x8
rflags                       0x10246    __ALIGN_SIZE+0xf246
rsp               0xffff80002a848be0
ss                              0x10
ffs2_balloc+0xa0a:      movq    0(%rcx,%rax,8),%r14
ddb> show proc
PROC (syz-executor) tid=392358 pid=24154 tcnt=1 stat=onproc
    flags process=2<EXEC> proc=1<INKTR>
    runpri=32, usrpri=72, slppri=32, nice=20
    wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0
    forw=0xffffffffffffffff, list=0xffff80002a736a68,0xffff80002a736548
    process=0xffff80002a79df90 user=0xffff80002a844000, vmspace=0xfffff1007be5c008
    estcpu=22, cpticks=7, pctcpu=0.0, user=1, sys=6, intr=0
ddb> ps
   PID     TID   PPID    UID  S       FLAGS  WAIT          COMMAND
 29723  239282  65174      0  2           0                syz-executor
 29723   93339  65174      0  3   0x4000080  fsleep        syz-executor
 52821   92923  65642      0  2           0                syz-executor
 52821  189376  65642      0  2   0x4000000                syz-executor
 72577   24069  93576      0  3        0x80  fsleep        syz-executor
 72577  361689  93576      0  3   0x4000080  bell          syz-executor
 86807  415350  49083      0  3        0x80  fsleep        syz-executor
 86807  461622  49083      0  3   0x4000080  kqread        syz-executor
 15587  214879  84770      0  2        0x80                syz-executor
 15587  427744  84770      0  2   0x4000000                syz-executor
 66786  276113  76465      0  3        0x80  fsleep        syz-executor
 66786  249594  76465      0  3   0x4000080  lockf         syz-executor
 20004   98928  24154      0  3        0x80  fsleep        syz-executor
 20004  267892  24154      0  3   0x4000080  pipewr        syz-executor
 25304   40314      1      0  3        0x80  nanoslp       init
 49083   93275  21614      0  2       0xc82                syz-executor
 65642   99380  21614      0  2       0xc82                syz-executor
 32791  114631  21614      0  2       0xc82                syz-executor
*24154  392358  21614      0  7         0x3                syz-executor
 84770  491151  21614      0  2       0xc82                syz-executor
 93576  396006  21614      0  2       0xc82                syz-executor
 65174  240272  21614      0  2       0xc82                syz-executor
 76465  374114  21614      0  2       0xc82                syz-executor
 21614  249558      1      0  3        0x82  kqread        syz-executor
 88257  384523      0      0  3     0x14200  bored         smr
 13351    4209      0      0  2     0x14200                zerothread
 84180  131863      0      0  3     0x14200  aiodoned      aiodoned
 81009  438730      0      0  3     0x14200  syncer        update
 24473  346521      0      0  3     0x14200  cleaner       cleaner
 29157   81296      0      0  3     0x14200  reaper        reaper
 76616  522291      0      0  3     0x14200  pgdaemon      pagedaemon
  4892  414859      0      0  3     0x14200  bored         viomb
 43338  379560      0      0  3  0x40014200  acpi0         acpi0
 90696  273211      0      0  3     0x14200  bored         softnet0
 82773  325727      0      0  3     0x14200  bored         systqmp
 36665  504410      0      0  3     0x14200  bored         systq
 95905  439529      0      0  3  0x40014200  tmoslp        softclock
 79208  368898      0      0  3  0x40014200                idle0
     1    9493      0      0  3        0x82  wait          init
     0       0     -1      0  3  0x10010200  scheduler     swapper
ddb> show all locks
No such command
ddb> 

Crashes (366):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/29 11:25 openbsd eed6eb79f3a4 6a0c72dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/29 04:16 openbsd a0c937b71e27 fb92f11c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/25 19:52 openbsd 452256cb16b9 432fd51a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/25 14:29 openbsd 452256cb16b9 432fd51a .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/24 07:38 openbsd 26c6eebc6662 042555ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/23 05:36 openbsd aa0f58e8a9e2 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/21 21:06 openbsd 500e6e56a2c4 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/21 07:43 openbsd ecd9e3ee9311 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/20 23:42 openbsd ecd9e3ee9311 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/20 01:05 openbsd e313e922acbc 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/19 17:07 openbsd e313e922acbc 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/18 21:05 openbsd aad3118e28ac 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 23:59 openbsd abb34060f546 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 20:10 openbsd abb34060f546 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 12:30 openbsd abb34060f546 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 10:42 openbsd 2f229140c828 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/17 08:53 openbsd 2f229140c828 62cc6db3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/15 08:51 openbsd e83fdb494821 c700a26e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/15 05:30 openbsd e83fdb494821 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/14 21:42 openbsd 009b3423c562 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/14 12:34 openbsd 46410a2bd49b 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/14 03:35 openbsd 46410a2bd49b 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/13 14:48 openbsd 4abe9ebbcc38 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/13 07:01 openbsd b5f1a9c5e77f 4f06757f .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/12 07:55 openbsd 10fabdd075df e93da63e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/11 05:04 openbsd 46422b23c8d1 b754d2d8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/11 00:41 openbsd 46422b23c8d1 b754d2d8 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/09 20:53 openbsd d89bad393cda c36c07f6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/09 14:06 openbsd d89bad393cda c36c07f6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/08 23:54 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/08 18:04 openbsd 867bf89e0da6 656e94c6 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/07 14:21 openbsd 55e221da9e96 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/06 09:47 openbsd f12de7fa2924 cc095639 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/02 11:48 openbsd 3e0a91e6cdcb cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/02 05:34 openbsd ce6468111c47 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/06/01 02:47 openbsd ca362689551c cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/31 09:52 openbsd b6d27d6c2ceb cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/31 04:43 openbsd 6568abc09117 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/30 15:33 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/30 08:32 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/30 05:25 openbsd 1e1be23b32e7 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/29 20:46 openbsd 0120f5b67b1e cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/28 19:36 openbsd 56a24c520999 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/27 19:50 openbsd ed6146792872 cb4e87ff .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/27 05:42 openbsd 51e8ce08d8c9 2b01f00e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/27 04:18 openbsd 51e8ce08d8c9 2b01f00e .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/26 13:43 openbsd d6937f154787 2b0043b4 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/05/26 03:40 openbsd 61b7e18e5713 c69befb3 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/03/27 02:05 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.