NetBSD Problem Report #60391

From www@netbsd.org  Wed Jul  1 00:27:52 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 2E3BF1A923A
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  1 Jul 2026 00:27:52 +0000 (UTC)
Message-Id: <20260701002751.06A771A9243@mollari.NetBSD.org>
Date: Wed,  1 Jul 2026 00:27:50 +0000 (UTC)
From: msaitoh@execsw.org
Reply-To: msaitoh@execsw.org
To: gnats-bugs@NetBSD.org
Subject: kernel panic in efi_init() with "options KASAN"
X-Send-Pr-Version: www-1.0
X-From4GNATS: "msaitoh@execsw.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60391
>Category:       kern
>Synopsis:       kernel panic in efi_init() with "options KASAN"
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jul 01 00:30:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Wed Jul 01 00:55:01 +0000 2026
>Originator:     SAITOH Masanobu
>Release:        netbsd-11
>Organization:
>Environment:
>Description:
On my own Intel Elkhart Lake and Twin Lake machine using with UEFI, "options KASAN" doesn't work.

----------
[   1.0000000] NetBSD 11.0_RC5 (GENERIC) #3: Tue Jun 30 22:19:58 JST 2026
[   1.0000000]  msaitoh@dl4000n.execsw.org:/disk/sources/netbsd-11/src/sys/arch/amd64/compile/GENERIC
[   1.0000000] total memory = 7868 MB
[   1.0000000] avail memory = 6364 MB
[   1.0000000] timecounter: Timecounters tick every 10.000 msec
[   1.0000000] NET_MPSAFE enabled
[   1.0000000] Kernelized RAIDframe activated
[   1.0000000] RTC BIOS diagnostic error 0x3f<config_unit,memory_size,fixed_disk,invalid_time>
[   1.0000000] timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
[   1.0000040] efi: systbl at pa 6fe65018
[   1.0000040] uvm_fault(0xffffffff82c14e40, 0xffff90000dfcc000, 1) -> e
[   1.0000040] fatal page fault in supervisor mode
[   1.0000040] trap type 6 code 0 rip 0xffffffff815dbae6 cs 0x8 rflags 0x10202 cr2 0xffff90000dfccb73 ilevel 0x8 rsp 0xffffffff8317dd70
[   1.0000040] curlwp 0xffffffff82a3e680 pid 0.0 lowest kstack 0xffffffff831762c0
kernel: page fault trap, code=0
Stopped in pid 0.0 (system) at  netbsd:kasan_memcpy+0x7e:       movzbl  0(%rdx,%
rsi,1),%r8d
kasan_memcpy() at netbsd:kasan_memcpy+0x7e
efi_init() at netbsd:efi_init+0x314
cpu_configure() at netbsd:cpu_configure+0x23
main() at netbsd:main+0x376
ds          dd90
es          0
fs          dd50
gs          dda0
rdi         ffffffff80825097    efi_init+0x314
rsi         ffff800000000000
rbp         ffffffff8317dd90
rbx         6fe65b98
rdx         10000dfccb73
rcx         80006fe65c08
rax         80006fe65b98
r8          0
r9          1ffff3e04a2b9c0e
r10         1ffffffff04f5c3a
r11         ffffffff82b6b837    bootinfo+0x7f7
r12         ffffffff82b467a0    efi_rt
r13         70
r14         ffff9f02515ce018
r15         0
rip         ffffffff815dbae6    kasan_memcpy+0x7e
cs          8
rflags      10202
rsp         ffffffff8317dd70
ss          10
netbsd:kasan_memcpy+0x7e:       movzbl  0(%rdx,%rsi,1),%r8d
----------

>How-To-Repeat:
Compile a kernel with "options KASAN" and boot it on some UEFI systems.

Note that the following message is printed when linking the kernel though I don't know if it's related to the problem:
ld: warning: netbsd has a LOAD segment with RWX permissions
>Fix:
The following diff(from riastradh@) fixes the problem:
Index: efi_machdep.c
===================================================================
RCS file: /cvsroot/src/sys/arch/x86/x86/efi_machdep.c,v
retrieving revision 1.6
diff -u -p -r1.6 efi_machdep.c
--- efi_machdep.c       22 May 2023 16:28:07 -0000      1.6
+++ efi_machdep.c       30 Jun 2026 17:07:32 -0000
@@ -773,7 +773,7 @@ efi_runtime_init(void)
         * it for now.
         */
        pmap_update(efi_runtime_pmap);
-       memcpy(&efi_rt, systbl->st_rt, sizeof(efi_rt));
+       (memcpy)(&efi_rt, systbl->st_rt, sizeof(efi_rt));
        pmap_deactivate_sync(efi_runtime_pmap, cookie);

        /*

Another solution to prevent the problem is to disable "options EFI_RUNTIME".

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 01 Jul 2026 00:53:16 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11 and pullup-10, inapplicable <10


From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60391 CVS commit: src/sys/arch/x86/x86
Date: Wed, 1 Jul 2026 00:52:22 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Jul  1 00:52:22 UTC 2026

 Modified Files:
 	src/sys/arch/x86/x86: efi_machdep.c

 Log Message:
 x86/efi: Bypass kASAN memcpy when copying the efi runtime.

 Fixes crash at boot with `options KASAN' enabled on EFI systems.

 We could try to find some way to exclude the EFI runtime mappings
 from kASAN, e.g. by hacking kasan_md_unsupported.  But there's a lot
 of detailed exclusions to pass through to that (every entry in the
 EFI memory map), and this is the only memcpy in the whole kernel that
 all those details are likely to be applicable.

 PR kern/60391: kernel panic in efi_init() with "options KASAN"


 To generate a diff of this commit:
 cvs rdiff -u -r1.6 -r1.7 src/sys/arch/x86/x86/efi_machdep.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search