kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL

["Shinichi Doyashiki via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60504
>Category:       kern
>Synopsis:       lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jul 25 08:10:00 +0000 2026
>Originator:     Shinichi Doyashiki
>Release:        NetBSD 11.99.7 as of around 2026-07
>Organization:
		at home
>Environment:
System: NetBSD kanade2.hq.csel.org 11.99.7 NetBSD 11.99.7 (KANADE2_12) #19: Wed Jul 22 21:21:05 UTC 2026 clare%kanade2.hq.csel.org@localhost:/export/netbsd/current/src/sys/arch/amd64/compile/KANADE2_12 amd64
Architecture: x86_64
Machine: amd64
>Description:
	lfs_cleanerd can kernel crash on load;
	due to lfs_sp NULL dereference in lfs_fcntl.

(gdb) target kvm /export/crash/netbsd.0.core
0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:779
779                     dumpsys();
(gdb) bt
#0  0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
    at ../../../../arch/amd64/amd64/machdep.c:779
#1  0xffffffff80ae8d3f in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:91
#2  0xffffffff80b32bbd in vpanic (fmt=fmt@entry=0xffffffff8110e736 "trap", ap=ap@entry=0xffffbd098af14b38)
    at ../../../../kern/subr_prf.c:288
#3  0xffffffff80b32c92 in panic (fmt=fmt@entry=0xffffffff8110e736 "trap") at ../../../../kern/subr_prf.c:209
#4  0xffffffff8023d04e in trap (frame=0xffffbd098af14c80) at ../../../../arch/amd64/amd64/trap.c:325
#5  0xffffffff80234ad4 in alltraps ()
#6  0xffffffff80a52ce6 in lfs_fcntl (v=0xffffbd098af14e40) at ../../../../ufs/lfs/lfs_vnops.c:2037
#7  lfs_fcntl (v=0xffffbd098af14e40) at ../../../../ufs/lfs/lfs_vnops.c:1851
#8  0xffffffff80bb9a7e in VOP_FCNTL (vp=0xffff82b4e4dc85c0, command=<optimized out>, data=<optimized out>,
    fflag=<optimized out>, cred=<optimized out>) at ../../../../kern/vnode_if.c:972
#9  0xffffffff80b446e8 in fcntl_forfs (fd=<optimized out>, fp=<optimized out>, cmd=-1610036220, arg=0x7f7fff4de728)
    at ../../../../kern/sys_descrip.c:226
#10 sys_fcntl (l=<optimized out>, uap=<optimized out>, retval=<optimized out>) at ../../../../kern/sys_descrip.c:385
#11 0xffffffff805cc341 in sy_call (sy=0xffffffff81460b20 <sysent+2208>, l=0xffff82b787816000, uap=0xffffbd098af15000,
    rval=0xffffbd098af14fb0) at ../../../../sys/syscallvar.h:65
#12 sy_invoke (sy=0xffffffff81460b20 <sysent+2208>, l=0xffff82b787816000, uap=0xffffbd098af15000, rval=0xffffbd098af14fb0,
    code=92) at ../../../../sys/syscallvar.h:94
#13 syscall (frame=0xffffbd098af15000) at ../../../../arch/x86/x86/syscall.c:137
#14 0xffffffff8021025d in handle_syscall ()

	trap in lfs_fcntl

(gdb) frame 4
#4  0xffffffff8023d04e in trap (frame=0xffffbd098af14c80) at ../../../../arch/amd64/amd64/trap.c:325
325                     panic("trap");
(gdb) p/x frame->tf_trapno
$1 = 0x6
(gdb) p/x frame->tf_err
$2 = 0x0
(gdb) p/x frame->tf_rip
$3 = 0xffffffff80a52ce6
(gdb) p/x frame->tf_rdx
$4 = 0x0
(gdb) x/i frame->tf_rip
   0xffffffff80a52ce6 <lfs_fcntl+2317>: mov    0x68(%rdx),%rdx
(gdb) frame 6
#6  0xffffffff80a52ce6 in lfs_fcntl (v=0xffffbd098af14e40) at ../../../../ufs/lfs/lfs_vnops.c:2037
2037                            lws.offset = lfs_btofsb(fs, fs->lfs_sp->bytes_written);

	following are just a log.

(gdb) info args
v = 0xffffbd098af14e40
(gdb) p *(struct vop_fcntl_args *)0xffffbd098af14e40
$5 = {a_desc = 0xffffffff810ea640 <vop_fcntl_desc>, a_vp = 0xffff82b4e4dc85c0, a_command = 2684931076,
  a_data = 0xffffbd098af14ed8, a_fflag = 1, a_cred = 0xffff82bab3b264c0}
(gdb) set $vp = (struct vnode *)0xffff82b4e4dc85c0
(gdb) p *$vp
$6 = {v_uobj = {vmobjlock = 0xffff82b7a77fee80, pgops = 0xffffffff810e3ec0 <uvm_vnodeops>, uo_npages = 0, uo_refs = 1,
    uo_pages = {t_root = 0x0, t_height = 0}, uo_ubc = {lh_first = 0x0}}, v_size = 18620416, v_writesize = 18620416, v_cv = {
    cv_opaque = {0x0, 0xffffffff81153a82}}, v_iflag = 16384, v_uflag = 0, v_usecount = -1073741822, v_numoutput = 0,
  v_writecount = 0, v_holdcnt = 152, v_cleanblkhd = {lh_first = 0xffff82b7eb4b9150}, v_dirtyblkhd = {
    lh_first = 0xffff82b3ecffc5c0}, v_vflag = 0, v_interlock = 0xffff82b7a4397b80, v_mount = 0xffff82b810360000,
  v_op = 0xffff82baafaada00, v_un = {vu_mountedhere = 0x0, vu_socket = 0x0, vu_specnode = 0x0, vu_fifoinfo = 0x0,
    vu_ractx = 0x0}, v_type = VREG, v_tag = VT_LFS, v_data = 0xffff82b80e94b038, v_klist = 0xffff82b4e4dc86d8, v_segvguard = 0x0}
(gdb) p/x $vp->v_data
$7 = 0xffff82b80e94b038
(gdb) set $ip = (struct inode *)0xffff82b80e94b038
(gdb) p *$ip
$8 = {i_gnode = {g_op = 0xffffffff810e2840 <lfs_genfsops>, g_glock = {rw_owner = 0}}, i_nextsnap = {tqe_next = 0x0,
    tqe_prev = 0x0}, i_vnode = 0xffff82b4e4dc85c0, i_ump = 0xffff82b83b1f1400, i_devvp = 0xffff82b379b6dac0, i_state = 9,
  i_dev = 43012, i_number = 1, i_lfs = 0xffff82b7427de000, i_unused1 = 0x0, i_dquot = {0x0, 0x0}, i_modrev = 790894361800104,
  i_lockf = 0x0, i_crap = {ulr_count = 0, ulr_endoff = 0, ulr_diroff = 0, ulr_offset = 0, ulr_reclen = 0}, i_crapcounter = 0,
  inode_ext = {lfs = 0xffff82b7c69cd038}, i_mode = 33152, i_nlink = 1, i_size = 18620416, i_flags = 131072, i_gen = 1,
  i_uid = 0, i_gid = 0, i_omode = 0, i_dirhash = 0x0, i_din = 0xffff82b80c0cc038}
(gdb) p/x $ip->i_lfs
$9 = 0xffff82b7427de000
(gdb) p/x ((struct lfs *)0xffff82b7427de000)->lfs_sp
$10 = 0x0

>How-To-Repeat:
	This crash was an incidental event and it is not clear how to reproduce it.
	In my opinion, this is caused by overloading the cleaning daemon and other processes.

	1. create a LFS partition approx 42GB
	2. explode current source tree (and objdirs et al) onto it
	   (fillup the filesystem)
	3. delete objdir, tooldir, destdir
	   (delete the fillers)
	4. run build.sh -j4 ...

>Fix:
	unknown.