NetBSD Problem Report #60534

From martin@duskware.de  Mon Aug  3 12:51:20 2026
Return-Path: <martin@duskware.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 22E7C1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Mon,  3 Aug 2026 12:51:20 +0000 (UTC)
Message-Id: <20260803125116.88B0EE2005C@mail.duskware.de>
Date: Mon, 03 Aug 2026 14:51:11 +0200 (CEST)
From: martin@NetBSD.org
Reply-To: martin@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: NULL deref in async IO code during ATF test run
X-Send-Pr-Version: 3.95
X-From4GNATS: "martin@NetBSD.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60534
>Category:       kern
>Synopsis:       NULL deref in async IO code during ATF test run
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 03 12:55:00 +0000 2026
>Last-Modified:  Mon Aug 03 13:15:37 +0000 2026
>Originator:     Martin Husemann
>Release:        NetBSD 11.99.7
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD thirdstage.duskware.de 11.99.7 NetBSD 11.99.7 (MODULAR) #908: Mon Aug  3 08:38:30 CEST 2026  martin@thirdstage.duskware.de:/home/martin/current/src/sys/arch/sparc64/compile/MODULAR sparc64
Architecture: sparc64
Machine: sparc64
>Description:

During an ATF test run, while doing the async IO tests, my kernel crashed:

[ 5154.8862761] cpu0: data fault: pc=1664e10 rpc=107786e8b addr=0
[ 5154.8862761] kernel trap 30: data access exception
Stopped in pid 13719.13719 (t_aio_suspend) at   netbsd:aiosp_validate_conflicts+
0x70:   ldx             [%o0 + 0x38], %g1
db{0}> sh reg
tstate      4482000604
pc          1664e10     aiosp_validate_conflicts+0x70
npc         1664e14     aiosp_validate_conflicts+0x74
ipl         0
y           0
g0          0
g1          0
g2          4000
g3          ffffffffffffd1a8
g4          ffffffffffffc851
g5          0
g6          996671fcafe93e33
g7          4021a890
o0          0
o1          0
o2          0
o3          0
o4          0
o5          0
o6          2531e3271
o7          1664e04     aiosp_validate_conflicts+0x64
l0          ffffffff00000000

This is at:

0x1664e10 is in aiosp_validate_conflicts (../../../../kern/sys_aio.c:1148).
1143                    if (job && st->job->aiocb_uptr == uptr) {
1144                            mutex_exit(&aiosp->mtx);
1145                            return EINVAL;
1146                    } else if (st->fg) {
1147                            mutex_enter(&st->fg->mtx);
1148 >>>                        TAILQ_FOREACH(job, &st->fg->queue, list) {
1149                                    if (job->aiocb_uptr == uptr) {
1150                                            mutex_exit(&st->fg->mtx);
1151                                            mutex_exit(&aiosp->mtx);
1152                                            return EINVAL;



>How-To-Repeat:
not sure yet, will retry to see if it is reproducable

>Fix:
n/a

>Release-Note:

>Audit-Trail:

>Unformatted:

Home	PR Database Search