NetBSD Problem Report #60658

From martin@duskware.de  Fri Aug 28 07:23:09 2026
Return-Path: <martin@duskware.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 7F0F31A923B
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 28 Aug 2026 07:23:09 +0000 (UTC)
Message-Id: <20260828072306.6EC1DE1FFBE@mail.duskware.de>
Date: Fri, 28 Aug 2026 09:23:01 +0200 (CEST)
From: martin@NetBSD.org
Reply-To: martin@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: netbsd32_process_read_dbregs() needs the same fix as native amd64 process_read_dbregs()
X-Send-Pr-Version: 3.95
X-From4GNATS: "martin@NetBSD.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60658
>Category:       kern
>Synopsis:       netbsd32_process_read_dbregs() needs the same fix as native amd64 process_read_dbregs()
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          pending-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Aug 28 07:25:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sat Oct 24 10:20:04 +0000 2026
>Originator:     Martin Husemann
>Release:        NetBSD 11.99.7
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD seven-days-to-the-wolves.aprisoft.de 11.99.7 NetBSD 11.99.7 (GENERIC) #885: Thu Aug 27 08:06:24 CEST 2026 martin@seven-days-to-the-wolves.aprisoft.de:/work/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

Running i386 atf tests on an amd64 kernel crashes the machine:

kernel diagnostic assertion "lwp_locked(l, NULL)" failed: file "../../../arch/x86/x86/dbregs.c", line 185

in netbsd32_process_read_dbregs()

>How-To-Repeat:
s/a

>Fix:
n/a

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60658 CVS commit: src/sys/compat/netbsd32
Date: Fri, 28 Aug 2026 16:02:32 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Fri Aug 28 16:02:32 UTC 2026

 Modified Files:
 	src/sys/compat/netbsd32: netbsd32_ptrace.c

 Log Message:
 netbsd32_ptrace: Fix locking around ptrace register access.

 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.9 -r1.10 src/sys/compat/netbsd32/netbsd32_ptrace.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60658 CVS commit: src/sys/kern
Date: Fri, 28 Aug 2026 16:15:15 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Fri Aug 28 16:15:15 UTC 2026

 Modified Files:
 	src/sys/kern: sys_process_lwpstatus.c

 Log Message:
 ptrace(2): Tidy register access: no sketchy function pointer casts.

 Followups for:

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG

 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.8 -r1.9 src/sys/kern/sys_process_lwpstatus.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60658 CVS commit: src/sys/kern
Date: Sat, 29 Aug 2026 12:46:56 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Aug 29 12:46:56 UTC 2026

 Modified Files:
 	src/sys/kern: sys_process_lwpstatus.c

 Log Message:
 ptrace(2): Fix compat32 register set types in previous.

 Not always `struct reg32' or `struct fpreg32', notably on arm32 --
 make sure to say `process_reg32'/`process_fpreg32'/`process_dbreg32'.
 (Here `compat32' means oabi?)

 Followups for:

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG

 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.9 -r1.10 src/sys/kern/sys_process_lwpstatus.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 29 Aug 2026 12:52:03 +0000
State-Changed-Why:
fixed in HEAD, needs pullup to whatever branches PR 60556 fixes go to


State-Changed-From-To: needs-pullups->open
State-Changed-By: martin@NetBSD.org
State-Changed-When: Wed, 02 Sep 2026 13:57:26 +0000
State-Changed-Why:
crashes a -current kernel again


From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/60658 (netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs())
Date: Wed, 2 Sep 2026 16:12:52 +0200

 I can reproduce the panic with todays kernel again:

 db{0}> bt
 breakpoint() at netbsd:breakpoint+0x5
 vpanic() at netbsd:vpanic+0x189
 kern_assert() at netbsd:kern_assert+0x4b
 x86_dbregs_read() at netbsd:x86_dbregs_read+0x17b
 netbsd32_process_read_dbregs() at netbsd:netbsd32_process_read_dbregs+0x1b
 netbsd32_proc_regio() at netbsd:netbsd32_proc_regio+0x92
 netbsd32_dodbregs() at netbsd:netbsd32_dodbregs+0x2a
 do_ptrace() at netbsd:do_ptrace+0x797
 netbsd32_ptrace() at netbsd:netbsd32_ptrace+0x42
 netbsd32_syscall() at netbsd:netbsd32_syscall+-0x23a741
 db{0}> dmesg
 [   1.0000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003,
 [   1.0000000]     2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013,
 [   1.0000000]     2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023,
 [   1.0000000]     2024, 2025, 2026
 [   1.0000000]     The NetBSD Foundation, Inc.  All rights reserved.
 [   1.0000000] Copyright (c) 1982, 1986, 1989, 1991, 1993
 [   1.0000000]     The Regents of the University of California.  All rights rese
 rved.

 [   1.0000000] NetBSD 11.99.8 (GENERIC) #887: Wed Sep  2 10:40:14 CEST 2026
 [   1.0000000]  martin@seven-days-to-the-wolves.aprisoft.de:/work/src/sys/arch/a
 md64/compile/GENERIC
 db{0}> show panic
 Panic string: kernel diagnostic assertion "pcb->pcb_dbregs != NULL" failed: file
  "../../../../arch/x86/x86/dbregs.c", line 186


 Martin

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60658 CVS commit: src/sys/compat/netbsd32
Date: Wed, 2 Sep 2026 16:39:41 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Sep  2 16:39:41 UTC 2026

 Modified Files:
 	src/sys/compat/netbsd32: netbsd32_ptrace.c

 Log Message:
 netbsd32_ptrace: Need to pre-allocate dbregs before read/write.

 Followup for:

 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.10 -r1.11 src/sys/compat/netbsd32/netbsd32_ptrace.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 02 Sep 2026 16:40:45 +0000
State-Changed-Why:
fixed the fixed


State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Tue, 20 Oct 2026 20:53:38 +0000
State-Changed-Why:
pullup-11 #540
pullup-10 #1385


From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60658 CVS commit: [netbsd-11] src/sys
Date: Sat, 24 Oct 2026 10:14:08 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sat Oct 24 10:14:08 UTC 2026

 Modified Files:
 	src/sys/arch/amd64/amd64 [netbsd-11]: process_machdep.c
 	src/sys/arch/i386/i386 [netbsd-11]: process_machdep.c
 	src/sys/arch/x86/include [netbsd-11]: dbregs.h
 	src/sys/arch/x86/x86 [netbsd-11]: dbregs.c
 	src/sys/compat/netbsd32 [netbsd-11]: netbsd32_ptrace.c
 	src/sys/kern [netbsd-11]: sys_process_lwpstatus.c
 	src/sys/sys [netbsd-11]: ptrace.h

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #540):

 	sys/kern/sys_process_lwpstatus.c: revision 1.6
 	sys/kern/sys_process_lwpstatus.c: revision 1.7
 	sys/kern/sys_process_lwpstatus.c: revision 1.8
 	sys/arch/x86/include/dbregs.h: revision 1.9
 	sys/kern/sys_process_lwpstatus.c: revision 1.9
 	sys/sys/ptrace.h: revision 1.78
 	sys/arch/x86/x86/dbregs.c: revision 1.16
 	sys/kern/sys_process_lwpstatus.c: revision 1.10
 	sys/arch/i386/i386/process_machdep.c: revision 1.98
 	sys/compat/netbsd32/netbsd32_ptrace.c: revision 1.10
 	sys/compat/netbsd32/netbsd32_ptrace.c: revision 1.11
 	sys/arch/amd64/amd64/process_machdep.c: revision 1.51

 ptrace/procfs: Take lwp lock around process_read/write_(fp)regs(32).

 And verify that the lwp is in LSSTOP state before trying to read.

 Otherwise, we might catch an lwp while it's still running on the CPU,
 with all FPU state active, making the result unstable and tripping
 assertions on some architectures.

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 proc_regio: Clarify control flow and sprinkle comments.

 Use `if (error) goto out' instead of `if (error == 0) error = ...' to
 make the error case non-linear and indented, and the success case a
 straight line of logic.

 No functional change intended.

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 x86: Pull dbregs buffer allocation out from under lwp_lock.

 Sprinkle assertions and notes about locking rules while here.

 PR kern/60595: System lockup using gdb(1) on kernel with DEBUG+LOCKDEBUG

 This fixes a bug that was revealed by lifting up rock while fixing:
 PR kern/60556: panic in process_read_fpregs_xmm

 netbsd32_ptrace: Fix locking around ptrace register access.
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()

 ptrace(2): Tidy register access: no sketchy function pointer casts.

 Followups for:
 PR port-amd64/60556: panic in process_read_fpregs_xmm
 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()

 ptrace(2): Fix compat32 register set types in previous.

 Not always `struct reg32' or `struct fpreg32', notably on arm32 --
 make sure to say `process_reg32'/`process_fpreg32'/`process_dbreg32'.
 (Here `compat32' means oabi?)

 Followups for:
 PR port-amd64/60556: panic in process_read_fpregs_xmm
 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()

 netbsd32_ptrace: Need to pre-allocate dbregs before read/write.

 Followup for:
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.50 -r1.50.4.1 src/sys/arch/amd64/amd64/process_machdep.c
 cvs rdiff -u -r1.97 -r1.97.4.1 src/sys/arch/i386/i386/process_machdep.c
 cvs rdiff -u -r1.8 -r1.8.38.1 src/sys/arch/x86/include/dbregs.h
 cvs rdiff -u -r1.15 -r1.15.32.1 src/sys/arch/x86/x86/dbregs.c
 cvs rdiff -u -r1.9 -r1.9.12.1 src/sys/compat/netbsd32/netbsd32_ptrace.c
 cvs rdiff -u -r1.5 -r1.5.2.1 src/sys/kern/sys_process_lwpstatus.c
 cvs rdiff -u -r1.77 -r1.77.2.1 src/sys/sys/ptrace.h

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60658 CVS commit: [netbsd-10] src/sys
Date: Sat, 24 Oct 2026 10:18:41 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sat Oct 24 10:18:41 UTC 2026

 Modified Files:
 	src/sys/arch/amd64/amd64 [netbsd-10]: process_machdep.c
 	src/sys/arch/i386/i386 [netbsd-10]: process_machdep.c
 	src/sys/arch/x86/include [netbsd-10]: dbregs.h
 	src/sys/arch/x86/x86 [netbsd-10]: dbregs.c
 	src/sys/compat/netbsd32 [netbsd-10]: netbsd32_ptrace.c
 	src/sys/kern [netbsd-10]: sys_process_lwpstatus.c
 	src/sys/sys [netbsd-10]: ptrace.h

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #1385):

 	sys/kern/sys_process_lwpstatus.c: revision 1.6
 	sys/kern/sys_process_lwpstatus.c: revision 1.7
 	sys/kern/sys_process_lwpstatus.c: revision 1.8
 	sys/arch/x86/include/dbregs.h: revision 1.9
 	sys/kern/sys_process_lwpstatus.c: revision 1.9
 	sys/sys/ptrace.h: revision 1.78
 	sys/arch/x86/x86/dbregs.c: revision 1.16
 	sys/kern/sys_process_lwpstatus.c: revision 1.10
 	sys/arch/i386/i386/process_machdep.c: revision 1.98
 	sys/compat/netbsd32/netbsd32_ptrace.c: revision 1.10
 	sys/compat/netbsd32/netbsd32_ptrace.c: revision 1.11
 	sys/arch/amd64/amd64/process_machdep.c: revision 1.51

 ptrace/procfs: Take lwp lock around process_read/write_(fp)regs(32).

 And verify that the lwp is in LSSTOP state before trying to read.

 Otherwise, we might catch an lwp while it's still running on the CPU,
 with all FPU state active, making the result unstable and tripping
 assertions on some architectures.

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 proc_regio: Clarify control flow and sprinkle comments.

 Use `if (error) goto out' instead of `if (error == 0) error = ...' to
 make the error case non-linear and indented, and the success case a
 straight line of logic.

 No functional change intended.

 PR port-amd64/60556: panic in process_read_fpregs_xmm

 x86: Pull dbregs buffer allocation out from under lwp_lock.

 Sprinkle assertions and notes about locking rules while here.

 PR kern/60595: System lockup using gdb(1) on kernel with DEBUG+LOCKDEBUG

 This fixes a bug that was revealed by lifting up rock while fixing:
 PR kern/60556: panic in process_read_fpregs_xmm

 netbsd32_ptrace: Fix locking around ptrace register access.
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()

 ptrace(2): Tidy register access: no sketchy function pointer casts.

 Followups for:
 PR port-amd64/60556: panic in process_read_fpregs_xmm
 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()

 ptrace(2): Fix compat32 register set types in previous.

 Not always `struct reg32' or `struct fpreg32', notably on arm32 --
 make sure to say `process_reg32'/`process_fpreg32'/`process_dbreg32'.
 (Here `compat32' means oabi?)

 Followups for:
 PR port-amd64/60556: panic in process_read_fpregs_xmm
 PR kern/60595: System lockup using gdb(1) on kernel with
 DEBUG+LOCKDEBUG
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()

 netbsd32_ptrace: Need to pre-allocate dbregs before read/write.

 Followup for:
 PR kern/60658: netbsd32_process_read_dbregs() needs the same fix as
 native amd64 process_read_dbregs()


 To generate a diff of this commit:
 cvs rdiff -u -r1.49 -r1.49.20.1 src/sys/arch/amd64/amd64/process_machdep.c
 cvs rdiff -u -r1.96 -r1.96.20.1 src/sys/arch/i386/i386/process_machdep.c
 cvs rdiff -u -r1.8 -r1.8.30.1 src/sys/arch/x86/include/dbregs.h
 cvs rdiff -u -r1.15 -r1.15.24.1 src/sys/arch/x86/x86/dbregs.c
 cvs rdiff -u -r1.9 -r1.9.4.1 src/sys/compat/netbsd32/netbsd32_ptrace.c
 cvs rdiff -u -r1.4.4.1 -r1.4.4.2 src/sys/kern/sys_process_lwpstatus.c
 cvs rdiff -u -r1.75.4.1 -r1.75.4.2 src/sys/sys/ptrace.h

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search