NetBSD Problem Report #60928

From martin@thirdstage.duskware.de  Mon Oct 26 17:04:48 2026
Return-Path: <martin@thirdstage.duskware.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id BCB3A1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 26 Oct 2026 17:04:48 +0000 (UTC)
Message-Id: <20261026170443.8CBF1E1FFF1@mail.duskware.de>
Date: Mon, 26 Oct 2026 18:04:38 +0100 (CET)
From: martin@NetBSD.org
Reply-To: martin@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: crash in aio atf tests
X-Send-Pr-Version: 3.95
X-From4GNATS: "martin@NetBSD.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60928
>Category:       kern
>Synopsis:       crash in aio atf tests
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Oct 26 17:05:00 +0000 2026
>Last-Modified:  Thu Oct 29 14:05:01 +0000 2026
>Originator:     Martin Husemann
>Release:        NetBSD 11.99.9
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD thirdstage.duskware.de 11.99.9 NetBSD 11.99.9 (MODULAR) #926: Mon Oct 26 09:23:58 CET 2026 martin@thirdstage.duskware.de:/home/martin/current/src/sys/arch/sparc64/compile/MODULAR sparc64
Architecture: sparc64
Machine: sparc64
>Description:

While runnint the ATF tests, this machine crashed:

[ 2255.2495780] cpu0: data fault: pc=169e850 rpc=10779730b addr=0
[ 2255.2495780] kernel trap 30: data access exception
Stopped in pid 12184.12184 (t_aio_suspend) at   netbsd:aiosp_validate_conflicts+
0x70:   ldx             [%o0 + 0x38], %g1
db{0}> sh reg
tstate      4482000601
pc          169e850     aiosp_validate_conflicts+0x70
npc         169e854     aiosp_validate_conflicts+0x74
ipl         0
y           0
g0          0
g1          0
g2          fefefefe00000000
g3          10e0d2c00
g4          ffffffffffffc851
g5          0
g6          c724ab5fa7c3e393
g7          4021a860
o0          0
o1          0
o2          0
o3          0
o4          0
o5          0
o6          2532f3271
o7          169e844     aiosp_validate_conflicts+0x64
l0          ffffffff00000000
l1          ffffffffffffffff
l2          0
l3          80713
l4          10df4eb58
l5          0
l6          ffffffffffffffff
l7          0
i0          ffffffffffffffff
i1          ffffffffffffffff
i2          ffffffffffffffff
i3          ffffffffffffffff
i4          ffffffffffffffff
i5          ffffffffffffffff
i6          fefefefefefefefe
i7          fefefefefefefe32

0x169e850 is in aiosp_validate_conflicts (../../../../kern/sys_aio.c:1148).
1143                    if (job && st->job->aiocb_uptr == uptr) {
1144                            mutex_exit(&aiosp->mtx);
1145                            return EINVAL;
1146                    } else if (st->fg) {
1147                            mutex_enter(&st->fg->mtx);
1148                            TAILQ_FOREACH(job, &st->fg->queue, list) {
1149                                    if (job->aiocb_uptr == uptr) {


The code hasn't changed in ages, but the compiler recently did?

>How-To-Repeat:
s/a

>Fix:
n/a

>Audit-Trail:
From: Rin Okuyama <rokuyama.rk@gmail.com>
To: gnats-bugs@netbsd.org, kern-bug-people@netbsd.org,
 gnats-admin@netbsd.org, netbsd-bugs@netbsd.org
Cc: 
Subject: Re: kern/60928: crash in aio atf tests
Date: Thu, 29 Oct 2026 22:52:31 +0900

 I couldn't reproduce this problem both with GENERIC- and MODULAR-
 based kernels on Sun Blade 100.

 Full ATF runs completed without panic. Also, when t_aio_suspend
 was repeatedly executed, it succeeded more than 5,000 times each
 without failure nor panic.

 Thanks,
 rin

From: Martin Husemann <martin@duskware.de>
To: Rin Okuyama <rokuyama.rk@gmail.com>
Cc: gnats-bugs@netbsd.org
Subject: Re: kern/60928: crash in aio atf tests
Date: Thu, 29 Oct 2026 15:00:23 +0100

 On Thu, Oct 29, 2026 at 10:52:31PM +0900, Rin Okuyama wrote:
 > I couldn't reproduce this problem both with GENERIC- and MODULAR-
 > based kernels on Sun Blade 100.
 > 
 > Full ATF runs completed without panic. Also, when t_aio_suspend
 > was repeatedly executed, it succeeded more than 5,000 times each
 > without failure nor panic.

 Yes, my next test run succeeded too.
 I looked at the genertated code and couldn't find something wrong there
 either.

 But I noticed that other places in sys_aio.c do check for NULL job entries
 in that queue.

 Martin

Home	PR Database Search