NetBSD Problem Report #59964

From wiz@netbsd.org  Fri Feb  6 16:00:42 2026
Return-Path: <wiz@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R13" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 96F7D1A923E
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  6 Feb 2026 16:00:42 +0000 (UTC)
Message-Id: <20260206160042.5216984D57@mail.netbsd.org>
Date: Fri,  6 Feb 2026 16:00:42 +0000 (UTC)
From: wiz@NetBSD.org
Reply-To: wiz@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: kernel diagnostic assertion "it->it_time.it_value.tv_sec >= 0" failed
X-Send-Pr-Version: 3.95
X-From4GNATS: "wiz@NetBSD.org via gnats" <gnats-admin@NetBSD.org>

>Number:         59964
>Category:       kern
>Synopsis:       kernel diagnostic assertion "it->it_time.it_value.tv_sec >= 0" failed
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    riastradh
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Feb 06 16:05:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Wed Mar 04 19:15:00 +0000 2026
>Originator:     Thomas Klausner
>Release:        NetBSD 11.99.5
>Organization:

>Environment:


Architecture: x86_64
Machine: amd64
>Description:
When running the self tests for sysutils/coreutils 9.10, there is a repeatable
kernel panic after the lines:
...
PASS: tests/test/test-N.sh
PASS: tests/test/test-diag.pl
test-file.sh:
SKIP: tests/test/test-file.sh
PASS: tests/misc/time-style.sh
PASS: tests/timeout/timeout.sh
PASS: tests/timeout/timeout-blocked.pl
timeout-group.sh:
SKIP: tests/timeout/timeout-group.sh

The kernel backtrace is:
(gdb) bt
#0  0xffffffff80239eca in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:709
#1  0xffffffff80e2ad3f in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:91
#2  0xffffffff80e75f15 in vpanic (fmt=0xffffffff81630328 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=ap@entry=0xffffdda5551f6e38) at /usr/src/sys/kern/subr_prf.c:288
#3  0xffffffff8105093e in kern_assert (fmt=fmt@entry=0xffffffff81630328 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ") at /usr/src/sys/lib/libkern/kern_assert.c:51
#4  0xffffffff80e4949d in itimer_settime (it=it@entry=0xffffa5b2e0287040) at /usr/src/sys/kern/kern_time.c:908
#5  0xffffffff80e4a2b4 in dotimer_settime (timerid=4, value=value@entry=0xffffdda5551f6f30, ovalue=ovalue@entry=0x0, flags=0, p=<optimized out>) at /usr/src/sys/kern/kern_time.c:1446
#6  0xffffffff80e4a4b2 in sys___timer_settime50 (l=0xffffa5bd536dd800, uap=0xffffdda5551f7000, retval=<optimized out>) at /usr/src/sys/kern/kern_time.c:1374
#7  0xffffffff805cea31 in sy_call (sy=0xffffffff81a8a5d0 <sysent+10704>, l=0xffffa5bd536dd800, uap=0xffffdda5551f7000, rval=0xffffdda5551f6fb0) at /usr/src/sys/sys/syscallvar.h:65
#8  sy_invoke (sy=0xffffffff81a8a5d0 <sysent+10704>, l=0xffffa5bd536dd800, uap=0xffffdda5551f7000, rval=0xffffdda5551f6fb0, code=446) at /use/src/sys/sys/syscallvar.h:94
#9  syscall (frame=0xffffdda5551f7000) at /disk/storage-202410/archive/foreign/src/sys/arch/x86/x86/syscall.c:137
#10 0xffffffff8021025d in handle_syscall ()

Core dump available on request.

On NetBSD 10 I could not reproduce the panic.
>How-To-Repeat:
cd /usr/pkgsrc/sysutils/coreutils
make test
>Fix:
Please.

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->riastradh
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Fri, 06 Feb 2026 23:37:53 +0000
Responsible-Changed-Why:
mine


State-Changed-From-To: open->analyzed
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 06 Feb 2026 23:37:53 +0000
State-Changed-Why:
Almost certainly arithmetic overlfow here:

1423			if ((flags & TIMER_ABSTIME) == 0) {
1424				if (it->it_clockid == CLOCK_REALTIME) {
1425					getnanotime(&now);
1426				} else { /* CLOCK_MONOTONIC */
1427					getnanouptime(&now);
1428				}
1429				timespecadd(&it->it_time.it_value, &now,
1430				    &it->it_time.it_value);
1431			}

https://nxr.netbsd.org/xref/src/sys/kern/kern_time.c?r=1.230#1429

Reproducer:

#include <err.h>
#include <limits.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <time.h>

int
main(void)
{
	timer_t t;
	struct sigevent ev = {
		.sigev_notify = SIGEV_SIGNAL,
		.sigev_signo = SIGALRM,
	};
	const struct itimerspec it = {
		.it_value = {INT64_MAX - 1000, 0},
		.it_interval = {0,0},
	};
	sigset_t mask, omask;
	int signo;

	if (sigemptyset(&mask) == -1)
		err(1, "sigemptyset");
	if (sigaddset(&mask, SIGALRM) == -1)
		err(1, "sigaddset");
	if (sigprocmask(SIG_BLOCK, &mask, &omask) == -1)
		err(1, "sigprocmask(SIG_BLOCK)");

	if (timer_create(CLOCK_REALTIME, &ev, &t) == -1)
		err(1, "timer_create");
	if (timer_settime(t, TIMER_RELTIME, &it, NULL) == -1)
		err(1, "timer_settime");
	if (sigwait(&mask, &signo) == -1)
		err(1, "sigwait");
	printf("signal %d (%s)\n", signo, strsignal(signo));
	fflush(stdout);
	return ferror(stdout);
}


State-Changed-From-To: analyzed->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 07 Feb 2026 01:49:10 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11/10/9


From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59964 CVS commit: src
Date: Sat, 7 Feb 2026 01:47:23 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Feb  7 01:47:23 UTC 2026

 Modified Files:
 	src/sys/kern: kern_time.c
 	src/tests/lib/libc/sys: t_getitimer.c t_timer_create.c

 Log Message:
 setitimer(2), timer_settime(2): Avoid arithmetic overflow.

 PR kern/59964: kernel diagnostic assertion
 "it->it_time.it_value.tv_sec >= 0" failed


 To generate a diff of this commit:
 cvs rdiff -u -r1.230 -r1.231 src/sys/kern/kern_time.c
 cvs rdiff -u -r1.5 -r1.6 src/tests/lib/libc/sys/t_getitimer.c
 cvs rdiff -u -r1.10 -r1.11 src/tests/lib/libc/sys/t_timer_create.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Thomas Klausner <wiz@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/59964 (kernel diagnostic assertion
 "it->it_time.it_value.tv_sec >= 0" failed)
Date: Sat, 7 Feb 2026 11:17:15 +0100

 Just to confirm, the coreutils tests now proceed without a panic in my
 environment.

 Thanks,
  Thomas

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59964 CVS commit: [netbsd-11] src
Date: Wed, 4 Mar 2026 19:10:32 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Wed Mar  4 19:10:31 UTC 2026

 Modified Files:
 	src/sys/kern [netbsd-11]: kern_time.c
 	src/tests/lib/libc/sys [netbsd-11]: t_getitimer.c t_timer_create.c

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #188):

 	sys/kern/kern_time.c: revision 1.230
 	sys/kern/kern_time.c: revision 1.231
 	tests/lib/libc/sys/t_getitimer.c: revision 1.6
 	tests/lib/libc/sys/t_timer_create.c: revision 1.11

 kern_time.c: Sprinkle SET_ERROR dtrace probes.

 PR kern/58378: Kernel error code origination lacks dtrace probes

 setitimer(2), timer_settime(2): Avoid arithmetic overflow.

 PR kern/59964: kernel diagnostic assertion
 "it->it_time.it_value.tv_sec >= 0" failed


 To generate a diff of this commit:
 cvs rdiff -u -r1.228.2.1 -r1.228.2.2 src/sys/kern/kern_time.c
 cvs rdiff -u -r1.5 -r1.5.2.1 src/tests/lib/libc/sys/t_getitimer.c
 cvs rdiff -u -r1.10 -r1.10.2.1 src/tests/lib/libc/sys/t_timer_create.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search