NetBSD Problem Report #60556

From www@netbsd.org  Fri Aug  7 23:58:13 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 14C011A9239
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  7 Aug 2026 23:58:13 +0000 (UTC)
Message-Id: <20260807235812.1B0F51A923B@mollari.NetBSD.org>
Date: Fri,  7 Aug 2026 23:58:12 +0000 (UTC)
From: nia@sent.at
Reply-To: nia@sent.at
To: gnats-bugs@NetBSD.org
Subject: panic in process_read_fpregs_xmm
X-Send-Pr-Version: www-1.0
X-From4GNATS: "nia@sent.at via gnats" <gnats-admin@NetBSD.org>

>Number:         60556
>Category:       port-amd64
>Synopsis:       panic in process_read_fpregs_xmm
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    port-amd64-maintainer
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 08 00:00:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sat Aug 29 12:50:01 +0000 2026
>Originator:     nia
>Release:        current
>Organization:
The NetBSD Fpregsdation
>Environment:
NetBSD siphon 11.99.7 NetBSD 11.99.7 (SIPHON) #0: Sun Aug  2 22:56:47 CEST 2026  nia@siphon:/encrypt/obj/sys/arch/amd64/compile/SIPHON amd64
>Description:
System panicked: kernel diagnostic assertion "!(l->l_md.md_flags & MDL_FPU_IN_CPU)" failed: file "/encrypt/src/sys/arch/x86/x86/fpu.c", line 173
Backtrace from time of crash is available.
crash> bt
oss_ioctl_sequencer() at 0
kern_reboot() at kern_reboot+0x5f
vpanic() at vpanic+0x193
kern_assert() at __x86_indirect_thunk_rax
process_read_fpregs_xmm() at process_read_fpregs_xmm+0x11f
process_read_fpregs() at process_read_fpregs+0x9
proc_regio() at proc_regio+0x6c
procfs_rw() at procfs_rw+0x67e
VOP_READ() at VOP_READ+0x42
vn_read() at vn_read+0x133
dofileread() at dofileread+0x75
sys_read() at sys_read+0x49
syscall() at syscall+0x9d
--- syscall (number 3) ---
syscall+0x9d:
>How-To-Repeat:
idk it happened while running IntelliJ IDEA
>Fix:

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 08 Aug 2026 00:46:32 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pulllup-10, pullup-9


From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60556 CVS commit: src/sys/kern
Date: Sat, 8 Aug 2026 00:45:53 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug  8 00:45:53 UTC 2026

 Modified Files:
 	src/sys/kern: sys_process_lwpstatus.c

 Log Message:
 ptrace/procfs: Take lwp lock around process_read/write_(fp)regs(32).

 And verify that the lwp is in LSSTOP state before trying to read.
 Otherwise, we might catch an lwp while it's still running on the CPU,
 with all FPU state active, making the result unstable and tripping
 assertions on some architectures.

 PR port-amd64/60556: panic in process_read_fpregs_xmm


 To generate a diff of this commit:
 cvs rdiff -u -r1.5 -r1.6 src/sys/kern/sys_process_lwpstatus.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60556 CVS commit: src/sys/kern
Date: Sat, 8 Aug 2026 12:38:32 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug  8 12:38:32 UTC 2026

 Modified Files:
 	src/sys/kern: sys_process_lwpstatus.c

 Log Message:
 proc_regio: Clarify control flow and sprinkle comments.

 Use `if (error) goto out' instead of `if (error == 0) error = ...' to
 make the error case non-linear and indented, and the success case a
 straight line of logic.

 No functional change intended.

 PR port-amd64/60556: panic in process_read_fpregs_xmm


 To generate a diff of this commit:
 cvs rdiff -u -r1.6 -r1.7 src/sys/kern/sys_process_lwpstatus.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60556 CVS commit: src/sys
Date: Thu, 20 Aug 2026 16:20:55 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Thu Aug 20 16:20:55 UTC 2026

 Modified Files:
 	src/sys/arch/amd64/amd64: process_machdep.c
 	src/sys/arch/i386/i386: process_machdep.c
 	src/sys/arch/x86/include: dbregs.h
 	src/sys/arch/x86/x86: dbregs.c
 	src/sys/kern: sys_process_lwpstatus.c
 	src/sys/sys: ptrace.h

 Log Message:
 x86: Pull dbregs buffer allocation out from under lwp_lock.

 Sprinkle assertions and notes about locking rules while here.

 PR kern/60595: System lockup using gdb(1) on kernel with DEBUG+LOCKDEBUG

 This fixes a bug that was revealed by lifting up rock while fixing:

 PR kern/60556: panic in process_read_fpregs_xmm


 To generate a diff of this commit:
 cvs rdiff -u -r1.50 -r1.51 src/sys/arch/amd64/amd64/process_machdep.c
 cvs rdiff -u -r1.97 -r1.98 src/sys/arch/i386/i386/process_machdep.c
 cvs rdiff -u -r1.8 -r1.9 src/sys/arch/x86/include/dbregs.h
 cvs rdiff -u -r1.15 -r1.16 src/sys/arch/x86/x86/dbregs.c
 cvs rdiff -u -r1.7 -r1.8 src/sys/kern/sys_process_lwpstatus.c
 cvs rdiff -u -r1.77 -r1.78 src/sys/sys/ptrace.h

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60556 CVS commit: src/sys/kern
Date: Fri, 28 Aug 2026 16:15:15 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Fri Aug 28 16:15:15 UTC 2026

 Modified Files:
 	src/sys/kern: sys_process_lwpstatus.c

 Log Message:
 ptrace(2): Tidy register access: no sketchy function pointer casts.

 Followups for:

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG

 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.8 -r1.9 src/sys/kern/sys_process_lwpstatus.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60556 CVS commit: src/sys/kern
Date: Sat, 29 Aug 2026 12:46:56 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug 29 12:46:56 UTC 2026

 Modified Files:
 	src/sys/kern: sys_process_lwpstatus.c

 Log Message:
 ptrace(2): Fix compat32 register set types in previous.

 Not always `struct reg32' or `struct fpreg32', notably on arm32 --
 make sure to say `process_reg32'/`process_fpreg32'/`process_dbreg32'.
 (Here `compat32' means oabi?)

 Followups for:

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG

 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.9 -r1.10 src/sys/kern/sys_process_lwpstatus.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search