NetBSD Problem Report #60893

From alnsn@netbsd.org  Sat Oct 17 12:41:21 2026
Return-Path: <alnsn@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 632251A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 17 Oct 2026 12:41:21 +0000 (UTC)
Message-Id: <20261017124120.349D41A923E@mollari.NetBSD.org>
Date: Sat, 17 Oct 2026 12:41:20 +0000 (UTC)
From: alnsn@NetBSD.org
Reply-To: alnsn@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: compat_linux inotify: find_entry() returns -1, handle_write() indexes ide_entries[-1], kernel panic
X-From4GNATS: "alnsn@NetBSD.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60893
>Category:       kern
>Synopsis:       compat_linux inotify: find_entry() returns -1, handle_write() indexes ide_entries[-1], kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 17 12:45:00 +0000 2026
>Originator:     Alexander Nasonov
>Release:        NetBSD 11.0_STABLE (netbsd-11), amd64
>Organization:
	home, sweet home
>Environment:
NetBSD 11.0_STABLE amd64, compat_linux loaded (module).  The KASSERT in
find_entry() did not fire, so the module was evidently built without
DIAGNOSTIC.  sys/compat/linux/common/linux_inotify.c is v1.8 on
netbsd-11; trunk (v1.11, 2026/09/20) has the same find_entry() and
handle_write().

>Description:
*** This PR was prepared by Claude (Anthropic's AI assistant, Claude Code
*** CLI) running on the reporter's NetBSD machine, from a kernel crash
*** dump and the source in /usr/src.  The reporter, Alexander Nasonov,
*** is submitting it.  The analysis has not been independently reviewed.

Running the native Linux x64 Claude Code CLI (a Bun binary, uses inotify)
under compat_linux panicked the kernel:

  uvm_fault(0xffffffff818f2220, 0xffff82810db99000, 1) -> e
  fatal page fault in supervisor mode
  trap type 6 code 0 rip 0xffffffff80e61fa0 ... cr2 0xffff82810db99e00
  curlwp ... pid 12428.12434
  panic: trap

  strlen <- do_kevent_to_inotify <- inotify_filt_event <- knote <-
  VOP_CREATE <- vn_open <- do_open <- do_sys_openat <- linux_sys_openat

i.e. an openat(O_CREAT) in a watched directory.

>How-To-Repeat:
Build the program below on Linux (or with a Linux compiler under
compat_linux) and run it under compat_linux.  It creates a directory
under the given path, watches it with inotify, and creates files in it.
Running it crashed the machine:

$ ./inotify-panic /var/shm
creating /var/shm/inotify312xWN/f0
creating /var/shm/inotify312xWN/f1

--- inotify-panic.c ---
#include <sys/inotify.h>
#include <fcntl.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int
main(int argc, char **argv)
{
	char dir[PATH_MAX];
	char path[PATH_MAX + 32];
	const char *base = argc > 1 ? argv[1] : "/tmp";
	int ifd, fd, i;

	setvbuf(stdout, NULL, _IONBF, 0);

	snprintf(dir, sizeof(dir), "%s/inotifyXXXXXX", base);
	if (mkdtemp(dir) == NULL) {
		perror("mkdtemp");
		return 1;
	}

	for (i = 0; i < 4; i++) {
		snprintf(path, sizeof(path), "%s/pre%d", dir, i);
		fd = open(path, O_CREAT | O_WRONLY, 0600);
		if (fd < 0) {
			perror("open");
			return 1;
		}
		close(fd);
	}

	ifd = inotify_init1(0);
	if (ifd < 0) {
		perror("inotify_init1");
		return 1;
	}
	if (inotify_add_watch(ifd, dir, IN_CREATE | IN_DELETE) < 0) {
		perror("inotify_add_watch");
		return 1;
	}

	for (i = 0; i < 1000; i++) {
		snprintf(path, sizeof(path), "%s/f%d", dir, i);
		printf("creating %s\n", path);
		fd = open(path, O_CREAT | O_WRONLY, 0600);
		if (fd < 0) {
			perror("open");
			return 1;
		}
		close(fd);
	}

	puts("no panic");
	return 0;
}
--- end ---

>Fix:
No patch (project policy on LLM-generated code).

Home	PR Database Search