syzbot


uvm_fault: ffs2_balloc (7)

Status: upstream: reported on 2026/03/27 02:05
Reported-by: syzbot+27c62742ccfde7447505@syzkaller.appspotmail.com
First crash: 29d, last: 2h50m
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd uvm_fault: ffs2_balloc (2) -1 3 1131d 1201d 0/3 auto-obsoleted due to no activity on 2023/06/18 20:00
openbsd uvm_fault: ffs2_balloc (5) -1 4 377d 525d 0/3 auto-obsoleted due to no activity on 2025/07/12 07:43
openbsd uvm_fault: ffs2_balloc (6) -1 10 137d 224d 0/3 auto-obsoleted due to no activity on 2026/03/09 12:43
openbsd uvm_fault: ffs2_balloc -1 1 1500d 1500d 0/3 auto-closed as invalid on 2022/06/14 20:58
openbsd uvm_fault: ffs2_balloc (3) -1 5 723d 826d 0/3 auto-obsoleted due to no activity on 2024/07/31 16:15
openbsd uvm_fault: ffs2_balloc (4) -1 17 587d 598d 0/3 auto-obsoleted due to no activity on 2024/11/04 07:48

Sample crash report:
uvm_fault(0xffffffff83a35d50, 0xffff80001fc75ff8, 0, 1) -> d
kernel: page fault trap, code=0
Stopped at      ffs2_balloc+0xa0a:      movq    0(%rcx,%rax,8),%r14
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*176448  96174      0           0  0x4000000    0  syz-executor
ffs2_balloc(fffffd806c7f3900,840002ffff,1,fffffd8007ffd4e0,3,ffff80002a77cd88) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a77ce10) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd806f8ea2b8,ffff80002a77cfc8,17,fffffd8007ffd4e0) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806ff7d960,ffff80002a77cfc8,0) at vn_write+0x1c2 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000364eb4e8,3,ffff80002a77cfc8,0,ffff80002a77d070) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff8000364eb4e8,ffff80002a77d120,ffff80002a77d070) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80002a77d120) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a77d120) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x51512b20750, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb> 
ddb> set $lines = 0
ddb> set $maxwidth = 0
ddb> show panic
*cpu0: uvm_fault(0xffffffff83a35d50, 0xffff80001fc75ff8, 0, 1) -> d
ddb> trace
ffs2_balloc(fffffd806c7f3900,840002ffff,1,fffffd8007ffd4e0,3,ffff80002a77cd88) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614
ffs_write(ffff80002a77ce10) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345
VOP_WRITE(fffffd806f8ea2b8,ffff80002a77cfc8,17,fffffd8007ffd4e0) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245
vn_write(fffffd806ff7d960,ffff80002a77cfc8,0) at vn_write+0x1c2 sys/kern/vfs_vnops.c:414
dofilewritev(ffff8000364eb4e8,3,ffff80002a77cfc8,0,ffff80002a77d070) at dofilewritev+0x2bd sys/kern/sys_generic.c:384
sys_write(ffff8000364eb4e8,ffff80002a77d120,ffff80002a77d070) at sys_write+0xa2 sys/kern/sys_generic.c:300
syscall(ffff80002a77d120) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80002a77d120) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x51512b20750, count: -8
ddb> 

Crashes (164):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/25 14:21 openbsd 7da61030019e 9c2d0995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/25 09:06 openbsd 2f70c1a437bc 9c2d0995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/25 06:04 openbsd 2f70c1a437bc 9c2d0995 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/24 22:23 openbsd 9aeaae004919 1c2b9291 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/24 12:57 openbsd 9aeaae004919 1c2b9291 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/24 10:56 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/24 09:52 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/24 06:00 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/24 04:29 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/23 23:39 openbsd 179a5728e367 9cfb3ca7 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/23 18:30 openbsd 7a2e62a4900c 4c3406dc .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/23 09:54 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/23 05:24 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/23 03:57 openbsd 18dcbfb1f230 b10da5ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/22 07:10 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/22 04:24 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/21 23:11 openbsd 9a8e8d261fbe 0b6ab7ec .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/21 19:04 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/21 17:55 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/21 15:08 openbsd 4470fcda88d1 9765efe0 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/21 07:56 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/21 06:41 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/21 05:04 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/21 04:00 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/21 02:10 openbsd 5ca82bba1a6e 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/20 19:28 openbsd 84954924bf04 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/20 17:53 openbsd 61290050a454 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/20 16:15 openbsd 84954924bf04 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/20 15:00 openbsd 61290050a454 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/20 05:38 openbsd be10f67bca99 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/19 23:52 openbsd be10f67bca99 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/19 19:16 openbsd 2fc67ad6b988 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/19 17:31 openbsd 2fc67ad6b988 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/19 14:50 openbsd 2fc67ad6b988 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/19 13:50 openbsd 2fc67ad6b988 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/19 10:41 openbsd 2fc67ad6b988 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/19 05:24 openbsd a6d33878ee16 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/18 22:34 openbsd a6d33878ee16 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/18 18:26 openbsd a9044055e1bf 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/18 16:38 openbsd a9044055e1bf 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/18 09:13 openbsd a9044055e1bf 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/18 05:20 openbsd b932b7b57eb9 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/18 04:15 openbsd b932b7b57eb9 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/18 02:38 openbsd b932b7b57eb9 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
2026/04/18 01:22 openbsd b932b7b57eb9 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/04/17 19:13 openbsd b932b7b57eb9 1a086e7c .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-main uvm_fault: ffs2_balloc
2026/03/27 02:05 openbsd 2f434a4256f3 4b3d9a38 .config console log report [disk image] [bsd.gdb] [kernel image] ci-openbsd-multicore uvm_fault: ffs2_balloc
* Struck through repros no longer work on HEAD.