NetBSD Problem Report #60168

From www@netbsd.org  Thu Apr  2 08:29:16 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R12" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 31FBF1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Thu,  2 Apr 2026 08:29:16 +0000 (UTC)
Message-Id: <20260402082915.0EC1C1A923C@mollari.NetBSD.org>
Date: Thu,  2 Apr 2026 08:29:15 +0000 (UTC)
From: r772577952@gmail.com
Reply-To: r772577952@gmail.com
To: gnats-bugs@NetBSD.org
Subject: panic: ASan: Unauthorized Access In ADDR: Addr ADDR [ADDR bytes, read, KmemRedZone]
X-Send-Pr-Version: www-1.0
X-From4GNATS: "r772577952@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60168
>Category:       kern
>Synopsis:       panic: ASan: Unauthorized Access In ADDR: Addr ADDR [ADDR bytes, read, KmemRedZone]
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Apr 02 08:30:01 +0000 2026
>Originator:     Jiaming Zhang
>Release:        image: NetBSD-10.1; kernel: trunk branch, commit fcca2226d50a3222f4010b6ef59cb5a1f9aa319b
>Organization:
>Environment:
NetBSD  11.99.5 NetBSD 11.99.5 (CLOUD) #0: Wed Apr  1 18:34:06 CST 2026  root@ustb520lab-MS-7E07:/vol/workdir/cloud-netbsd-dev/netbsd/20260401-fcca2226/src/sys/arch/amd64/compile/obj/CLOUD amd64
>Description:
When fuzzing NetBSD kernel with syzkaller and our generated syscall descriptions, we encountered an issue: panic: ASan: Unauthorized Access In ADDR: Addr ADDR [ADDR bytes, read, KmemRedZone]. This issues is reproducible in a recent version of NetBSD kernel (commit fcca2226d50a3222f4010b6ef59cb5a1f9aa319b).

The kernel console output, kernel config, and reproducers are available at: https://drive.google.com/drive/folders/1bvheteZZzwHwrsw0O_iJ-e9L6wsTXMrf?usp=sharing

The symbolized issue report is also shown below to help with analysis:

```
TITLE: panic: ASan: Unauthorized Access In ADDR: Addr ADDR [ADDR bytes, read, KmemRedZone]
CORRUPTED: true (matched title but not report regexp)
SUPPRESSED: false
MAINTAINERS (TO): []
MAINTAINERS (CC): []

login: [  16.1568206] panic: ASan: Unauthorized Access In 0xffffffff81dbf7d6: Addr 0xffffb980057e0b00 [18446744073709551599 bytes, read, KmemRedZone]

[  16.1568206] cpu0: Begin traceback...
[  16.1568206] asan.module_ctor() at ffffffff81ebbd0e
[  16.1668269] asan.module_ctor() at ffffffff81ebb905
[  16.1768239] kasan_report() at netbsd:kasan_report+0x6a
[  16.1868237] asan.module_dtor() at ffffffff81e5d852
[  16.1968272] kqueue_ioctl() at netbsd:kqueue_ioctl+0x1d6 vol/workdir/cloud-netbsd-dev/netbsd/20260401-fcca2226/src/sys/kern/kern_event.c:2562
[  16.1968272] asan.module_ctor() at ffffffff81ef2e5f
[  16.2168249] asan.module_dtor() at ffffffff81e1c909
[  16.2268233] syscall() at netbsd:syscall+0x26d sy_call vol/workdir/cloud-netbsd-dev/netbsd/20260401-fcca2226/src/sys/sys/syscallvar.h:65 [inline]
[  16.2268233] syscall() at netbsd:syscall+0x26d sy_invoke vol/workdir/cloud-netbsd-dev/netbsd/20260401-fcca2226/src/sys/sys/syscallvar.h:94 [inline]
[  16.2268233] syscall() at netbsd:syscall+0x26d vol/workdir/cloud-netbsd-dev/netbsd/20260401-fcca2226/src/sys/arch/x86/x86/syscall.c:137
[  16.2268233] --- syscall (number 54 via SYS_syscall) ---
[  16.2368254] netbsd:syscall+0x26d:
[  16.2368254] cpu0: End traceback...

[  16.2368254] dumping to dev 168,1 (offset=29361126, size=524159):
[  16.2368254] dump 607 606 605 604 603 602 601 600 599 598 597 596 595 594 593 592 591 590 589 588 587 586 585 584 583 582 581 580 579 578 577 576 575 574 573 572 571 570 569 568 567 566 565 564 563 562 561 560 559 558 557 556 555 554 553 552 551 550 549 548 
```
>How-To-Repeat:
The issues can be reproduced by running the C or syz reproducer on the kernel under a specified config.
>Fix:

Home	PR Database Search