NetBSD Problem Report #60305

From www@netbsd.org  Mon Jun  1 21:32:53 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id A8CCC1A9239
	for <gnats-bugs@gnats.NetBSD.org>; Mon,  1 Jun 2026 21:32:53 +0000 (UTC)
Message-Id: <20260601213252.ACBA81A923B@mollari.NetBSD.org>
Date: Mon,  1 Jun 2026 21:32:52 +0000 (UTC)
From: logix@foobar.franken.de
Reply-To: logix@foobar.franken.de
To: gnats-bugs@NetBSD.org
Subject: panic in AIO
X-Send-Pr-Version: www-1.0
X-From4GNATS: "logix@foobar.franken.de via gnats" <gnats-admin@NetBSD.org>

>Number:         60305
>Category:       kern
>Synopsis:       panic in AIO
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    christos
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 01 21:35:00 +0000 2026
>Last-Modified:  Tue Jun 02 10:30:02 +0000 2026
>Originator:     Harold Gutch
>Release:        NetBSD current (~late 2026-03) kernel, chroot with 11.0 RC2 userland
>Organization:
The NEiTher kernel nor curproc BSD Foundation
>Environment:
NetBSD nintendo 11.99.5 NetBSD 11.99.5 (NINTENDO.MP) #9: Sat Mar 28 13:06:02 CET 2026  h@build:/home/h/netbsd/wiiu/sys/arch/evbppc/compile/NINTENDO.MP evbppc
>Description:
On a NetBSD current (~late 2026-03) evbppc installation running on a Wii U with a chroot with an 11.0 RC2 userland, building pkgsrc/net/nsca-ng (from pkgsrc 2026Q1) crashes the system:

panic: kernel diagnostic assertion "(VMSPACE_IS_KERNEL_P(uio->uio_vmspace) || uio->uio_vmspace == curproc->p_vmspace)" failed: file "/home/h/netbsd/git/src/sys/miscfs/specfs/spec_vnops.c", line 1217 vmspace belongs to neither kernel nor curproc
0x00e63d70: at kern_assert+0x60
0x00e63db0: at spec_write+0x3cc
0x00e63e20: at VOP_WRITE+0x9c
0x00e63e60: at vn_write+0xf0
0x00e63e90: at aiost_process_singleton+0x120
0x00e63ee0: at aiost_entry+0x2ac
0x00e63f20: at cpu_lwp_bootstrap+0xc
0x00e63fe8: at 0xfffffffc
>How-To-Repeat:
1) get NetBSD current running on WiiU
2) create chroot, populate directory with sets from ~11.0RC2 (I was using 20260308105915Z)
3) download/unpack pkgsrc 2026Q1 in chroot
4) kver -r 11.0 chroot /chroot/root /bin/sh
5) build pkgsrc/net/nsca-ng

(presumably the arch in step 1 and the pkgsrc release in step 3 are irrelevant, and step 4 can be skipped)
>Fix:

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->christos
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Mon, 01 Jun 2026 21:43:06 +0000
Responsible-Changed-Why:
Looks like this bug was introduced in the 2025 overhaul of aio which
switched from one thread per process created with lwp_create to a pool
of _kthreads_ created with kthread_create, which have no associated
process:

-       error = lwp_create(curlwp, p, uaddr, 0, NULL, 0, aio_worker,
-           NULL, &l, curlwp->l_class, &curlwp->l_sigmask, &curlwp->l_sigstk);
-       if (error != 0) {
-               uvm_uarea_free(uaddr);
-               aio_exit(p, aio);
...
+       int error = kthread_create(PRI_NONE, KTHREAD_MUSTJOIN | KTHREAD_TS,
+           NULL, aiost_entry, st, &st->lwp, "aio_%d_%ld", p->p_pid,
+           sp->nthreads_total);

Apparently we have no automatic tests of aio on character devices, or
else we would have hit this assertion immediately in testing.


From: Harold Gutch <logix@foobar.franken.de>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/60305: panic in AIO
Date: Tue, 2 Jun 2026 12:25:07 +0200

 --3XA6nns4nE4KvaS/
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline

 riastradh@ reduced the test case to the attached code.  It panics in
 the aio_read(), so for an absolutely *minimal* reproducer that is all
 that is needed.

 This panics the same way a vanilly amd64 current - tested as an
 unprivileged user in an amd64 live image running on a VM.

 --3XA6nns4nE4KvaS/
 Content-Type: text/x-csrc; charset=us-ascii
 Content-Disposition: attachment; filename="aionull.c"

 #include <aio.h>
 #include <err.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>

 int
 main(void)
 {
 	char buf;
 	struct aiocb aio = {
 		.aio_offset = 0,
 		.aio_buf = &buf,
 		.aio_nbytes = 1,
 		.aio_fildes = -1,
 	};
 	ssize_t nread;

 	aio.aio_fildes = open("/dev/null", O_RDONLY);
 	if (aio.aio_fildes == -1)
 		err(EXIT_FAILURE, "open /dev/null");
 	if (aio_read(&aio) == -1)
 		err(EXIT_FAILURE, "aio_read");
 	if (aio_suspend((const struct aiocb *[]){&aio}, 1, NULL) == -1)
 		err(EXIT_FAILURE, "aio_suspend");
 	if (aio_error(&aio) == -1)
 		err(EXIT_FAILURE, "aio_error");
 	nread = aio_return(&aio);
 	if (nread == -1)
 		err(EXIT_FAILURE, "aio_return");
 	printf("read %zu byte%s\n", (size_t)nread, nread == 1 ? "" : "s");
 	return 0;
 }

 --3XA6nns4nE4KvaS/--

>Unformatted:

Home	PR Database Search