Bug 295348 - ufs: support unmapped bufs causing panic: vm_fault_lookup
Summary: ufs: support unmapped bufs causing panic: vm_fault_lookup
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 16.0-CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Konstantin Belousov
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2026-05-16 23:55 UTC by Alastair Hogge
Modified: 2026-05-23 07:14 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alastair Hogge 2026-05-16 23:55:03 UTC
On 16-CURRENT, the recently committed "ufs: support unmapped bufs for indirect blocks in bmap"[1], is causing a panic if the host is loaded. This is reproducible locally when a release.sh build, and poudriere-(testport|bulk) are run concurrently. release.sh is using null mounted ${SRC}, and ${PORTS}, and tmpfs ${CHROOTDIR}, poudriere is configured with tmpfs all. The host is an AMD EPYC 7742 64-Core Processor with 125GiB usable system memory.

> panic: vm_fault_lookup: fault on nofault entry, addr: 0xfffffe00b2840000
> cpuid = 34
> time = 1778975305
> KDB: stack backtrace:
> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0453921470
> vpanic() at vpanic+0x149/frame 0xfffffe04539215a0
> panic() at panic+0x43/frame 0xfffffe0453921600
> vm_fault() at vm_fault+0x1c0a/frame 0xfffffe0453921780
> vm_fault_trap() at vm_fault_trap+0x65/frame 0xfffffe04539217c0
> trap_pfault() at trap_pfault+0x274/frame 0xfffffe0453921830
> calltrap() at calltrap+0x8/frame 0xfffffe0453921830
> --- trap 0xc, rip = 0xffffffff80a9b100, rsp = 0xfffffe0453921900, rbp = 0xfffffe04539219a0 ---
> ufs_bmap_seekdata() at ufs_bmap_seekdata+0x340/frame 0xfffffe04539219a0
> ufs_ioctl() at ufs_ioctl+0x5f/frame 0xfffffe04539219d0
> VOP_IOCTL_APV() at VOP_IOCTL_APV+0x51/frame 0xfffffe0453921a00
> vn_generic_copy_file_range() at vn_generic_copy_file_range+0x3b4/frame 0xfffffe0453921c00
> vn_copy_file_range() at vn_copy_file_range+0x2e7/frame 0xfffffe0453921ce0
> kern_copy_file_range() at kern_copy_file_range+0x47c/frame 0xfffffe0453921dc0
> sys_copy_file_range() at sys_copy_file_range+0x78/frame 0xfffffe0453921e10
> amd64_syscall() at amd64_syscall+0x164/frame 0xfffffe0453921f30
> fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0453921f30
> --- syscall (569, FreeBSD ELF64, copy_file_range), rip = 0x824a11aba, rsp = 0x820893a38, rbp = 0x820893d70 ---
> KDB: enter: panic
> [ thread pid 3235 tid 101303 ]
> Stopped at      kdb_enter+0x33: movq    $0,0xba0cd2(%rip)
> db> 

1: https://codeberg.org/FreeBSD/freebsd-src/commit/bab04ddf1fd4b7a77d1cfae4a67ededf1f35ee0d
Comment 1 Konstantin Belousov freebsd_committer freebsd_triage 2026-05-17 00:12:33 UTC
Try https://reviews.freebsd.org/D57036
Comment 2 Alastair Hogge 2026-05-17 00:27:39 UTC
(In reply to Konstantin Belousov from comment #1)
Gladly when the fsck completes in 1-2 hours.
Comment 3 Alastair Hogge 2026-05-17 03:01:56 UTC
(In reply to Konstantin Belousov from comment #1)
That is working, I am unable to reproduce the panic. Thanks
Comment 4 commit-hook freebsd_committer freebsd_triage 2026-05-17 22:10:16 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=8ad8643a66735d28dac53a772856c94ca65b2bf3

commit 8ad8643a66735d28dac53a772856c94ca65b2bf3
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-05-17 00:09:21 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-05-17 22:09:26 +0000

    ufs: ufs_bmap_seekdata() needs mapped buffer for scan

    PR:     295348
    Reported and tested by:  Alastair Hogge <agh@riseup.net>
    Reviewed by:    mckusick
    Fixes:  bab04ddf1fd4 ("ufs: support unmapped bufs for indirect blocks in bmap")
    MFC after:      1 week
    Differential revision:  https://reviews.freebsd.org/D57036

 sys/ufs/ufs/ufs_bmap.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)
Comment 5 commit-hook freebsd_committer freebsd_triage 2026-05-23 07:14:12 UTC
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=3564e33b6099fcdfce4371fcf51c7f462823e012

commit 3564e33b6099fcdfce4371fcf51c7f462823e012
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2026-05-17 00:09:21 +0000
Commit:     Konstantin Belousov <kib@FreeBSD.org>
CommitDate: 2026-05-23 06:56:13 +0000

    ufs: ufs_bmap_seekdata() needs mapped buffer for scan

    PR:     295348

    (cherry picked from commit 8ad8643a66735d28dac53a772856c94ca65b2bf3)

 sys/ufs/ufs/ufs_bmap.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)