NetBSD Problem Report #60657

From www@netbsd.org  Thu Aug 27 22:03:43 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 945621A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 27 Aug 2026 22:03:43 +0000 (UTC)
Message-Id: <20260827220342.A733A1A923C@mollari.NetBSD.org>
Date: Thu, 27 Aug 2026 22:03:42 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: panic: kernel diagnostic assertion "epp->ep_emul_arg == NULL" failed: file "/home/riastradh/netbsd/current/src/sys/kern/kern_exec.c", line 535
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60657
>Category:       kern
>Synopsis:       panic: kernel diagnostic assertion "epp->ep_emul_arg == NULL" failed: file "/home/riastradh/netbsd/current/src/sys/kern/kern_exec.c", line 535
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 27 22:05:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Thu Oct 08 16:01:09 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, if not 11 and older
>Organization:
The NexecBSData Limitation, Inc.
>Environment:
>Description:
check_exec: rejecting due to data limit (20296 > 0)
panic: kernel diagnostic assertion "epp->ep_emul_arg == NULL" failed: file "/home/riastradh/netbsd/current/src/sys/kern/kern_exec.c", line 535
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x189
kern_assert() at netbsd:kern_assert+0x4b
check_exec() at netbsd:check_exec+0x566
execve_loadvm() at netbsd:execve_loadvm+0x1fa
execve1() at netbsd:execve1+0x39
sys_execve() at netbsd:sys_execve+0x2a
syscall() at netbsd:syscall+0x9d
--- syscall (number 59) ---
netbsd:syscall+0x9d:
cpu0: End traceback...

>How-To-Repeat:
1. set RLIMIT_DATA to 0
2. execve(2)
>Fix:
judiciously placed call to exec_free_emul_arg

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60657 CVS commit: src/sys/kern
Date: Fri, 28 Aug 2026 06:33:50 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Fri Aug 28 06:33:50 UTC 2026

 Modified Files:
 	src/sys/kern: exec_script.c kern_exec.c

 Log Message:
 exec: Free struct exec_package::ep_emul_arg in more error paths.

 We should really formalize the destruction path for these temporary
 exec data structures; these error branches are all tangled messes of
 spaghetti.

 PR kern/60657: panic: kernel diagnostic assertion "epp->ep_emul_arg
 == NULL" failed: file
 "/home/riastradh/netbsd/current/src/sys/kern/kern_exec.c", line 535

 Test case forthcoming (it would panic the testbed) as part of

 PR kern/60653: posix_spawn(3) causes incorrect stack base information

 which is how I stumbled upon this.


 To generate a diff of this commit:
 cvs rdiff -u -r1.85 -r1.86 src/sys/kern/exec_script.c
 cvs rdiff -u -r1.533 -r1.534 src/sys/kern/kern_exec.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Thu, 08 Oct 2026 16:01:09 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10


>Unformatted:

Home	PR Database Search