Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl; lfs_sp == NULL

["Shinichi Doyashiki via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60504; it has been noted by GNATS.

From: Shinichi Doyashiki <clare%csel.org@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/60504: lfs_cleanerd can kernel crash on load in lfs_fcntl;
 lfs_sp == NULL
Date: Tue, 28 Jul 2026 05:44:07 +0900

 kernel crash was triggered while running cvs update on the testing LFS partition.
 first and second savecore was failed due to crash kernel again
 while running savecore itself.  following are taken from third kernel crash.
 lfs_sp == NULL deref on fcntl command 2684931076 in lfs_vnops.c line 2037,
 same location, reproduced crash.
 
 gdb) target kvm /export/crash/netbsd.15.core
 0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260,
     bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:779
 779                     dumpsys();
 (gdb) bt
 #0  0xffffffff80239c5a in cpu_reboot (howto=howto@entry=260,
     bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:779
 #1  0xffffffff80ae8e6f in kern_reboot (howto=howto@entry=260,
     bootstr=bootstr@entry=0x0) at ../../../../kern/kern_reboot.c:91
 #2  0xffffffff80b32ced in vpanic (fmt=fmt@entry=0xffffffff8110e72e "trap",
     ap=ap@entry=0xffffbf89470b5b38) at ../../../../kern/subr_prf.c:288
 #3  0xffffffff80b32dc2 in panic (fmt=fmt@entry=0xffffffff8110e72e "trap")
     at ../../../../kern/subr_prf.c:209
 #4  0xffffffff8023d04e in trap (frame=0xffffbf89470b5c80)
     at ../../../../arch/amd64/amd64/trap.c:325
 #5  0xffffffff80234ad4 in alltraps ()
 #6  0xffffffff80a52e16 in lfs_fcntl (v=0xffffbf89470b5e40)
     at ../../../../ufs/lfs/lfs_vnops.c:2037
 #7  lfs_fcntl (v=0xffffbf89470b5e40) at ../../../../ufs/lfs/lfs_vnops.c:1851
 #8  0xffffffff80bb9bae in VOP_FCNTL (vp=0xffff854afc2cb080,
     command=<optimized out>, data=<optimized out>, fflag=<optimized out>,
     cred=<optimized out>) at ../../../../kern/vnode_if.c:972
 #9  0xffffffff80b44818 in fcntl_forfs (fd=<optimized out>, fp=<optimized out>,
     cmd=-1610036220, arg=0x7f7fff4e1e08) at ../../../../kern/sys_descrip.c:226
 #10 sys_fcntl (l=<optimized out>, uap=<optimized out>, retval=<optimized out>)
     at ../../../../kern/sys_descrip.c:385
 #11 0xffffffff805cc341 in sy_call (sy=0xffffffff81460b20 <sysent+2208>,
     l=0xffff854afa92a800, uap=0xffffbf89470b6000, rval=0xffffbf89470b5fb0)
     at ../../../../sys/syscallvar.h:65
 #12 sy_invoke (sy=0xffffffff81460b20 <sysent+2208>, l=0xffff854afa92a800,
     uap=0xffffbf89470b6000, rval=0xffffbf89470b5fb0, code=92)
     at ../../../../sys/syscallvar.h:94
 #13 syscall (frame=0xffffbf89470b6000)
     at ../../../../arch/x86/x86/syscall.c:137
 #14 0xffffffff8021025d in handle_syscall ()
 
 failed in same location.
 
 gdb) frame 4
 #4  0xffffffff8023d04e in trap (frame=0xffffbf89470b5c80)
     at ../../../../arch/amd64/amd64/trap.c:325
 325                     panic("trap");
 (gdb) p/x frame->tf_trapno
 $1 = 0x6
 (gdb) p/x frame->tf_err
 $2 = 0x0
 (gdb) p/x frame->tf_rip
 $3 = 0xffffffff80a52e16
 (gdb) p/x frame->tf_rdx
 $4 = 0x0
 (gdb) x/i frame->tf_rip
    0xffffffff80a52e16 <lfs_fcntl+2317>: mov    0x68(%rdx),%rdx
 (gdb) frame 6
 #6  0xffffffff80a52e16 in lfs_fcntl (v=0xffffbf89470b5e40)
     at ../../../../ufs/lfs/lfs_vnops.c:2037
 2037                            lws.offset = lfs_btofsb(fs, fs->lfs_sp->bytes_written);
 
 failed in same fcntl command.
 
 (gdb) info args
 v = 0xffffbf89470b5e40
 gdb) p *(struct vop_fcntl_args *)0xffffbf89470b5e40
 $5 = {a_desc = 0xffffffff810ea640 <vop_fcntl_desc>, a_vp = 0xffff854afc2cb080,
   a_command = 2684931076, a_data = 0xffffbf89470b5ed8, a_fflag = 1,
   a_cred = 0xffff855233b26040}
 (gdb) p *$vp
 $6 = {v_uobj = {vmobjlock = 0xffff854afb693100,
     pgops = 0xffffffff810e3ec0 <uvm_vnodeops>, uo_npages = 0, uo_refs = 1,
     uo_pages = {t_root = 0x0, t_height = 0}, uo_ubc = {lh_first = 0x0}},
   v_size = 32980992, v_writesize = 32980992, v_cv = {cv_opaque = {0x0,
       0xffffffff81153aa4}}, v_iflag = 16384, v_uflag = 0,
   v_usecount = -1073741821, v_numoutput = 0, v_writecount = 0,
   v_holdcnt = 3627, v_cleanblkhd = {lh_first = 0xffff854b03de0d80},
   v_dirtyblkhd = {lh_first = 0xffff854b03de0e98}, v_vflag = 0,
   v_interlock = 0xffff854b07ec0c40, v_mount = 0xffff854afb88a000,
   v_op = 0xffff85522faada00, v_un = {vu_mountedhere = 0x0, vu_socket = 0x0,
     vu_specnode = 0x0, vu_fifoinfo = 0x0, vu_ractx = 0x0}, v_type = VREG,
   v_tag = VT_LFS, v_data = 0xffff854afbdcc038, v_klist = 0xffff854afc2cb198,
   v_segvguard = 0x0}
 (gdb) p/x $vp->v_data
 $7 = 0xffff854afbdcc038
 (gdb) set $ip = (struct inode *)0xffff854afbdcc038
 (gdb) p *$ip
 $8 = {i_gnode = {g_op = 0xffffffff810e2840 <lfs_genfsops>, g_glock = {
       rw_owner = 0}}, i_nextsnap = {tqe_next = 0x0, tqe_prev = 0x0},
   i_vnode = 0xffff854afc2cb080, i_ump = 0xffff854af8f64600,
   i_devvp = 0xffff854af9354580, i_state = 9, i_dev = 43011, i_number = 1,
   i_lfs = 0xffff854afa950000, i_unused1 = 0x0, i_dquot = {0x0, 0x0},
   i_modrev = 1615681151458, i_lockf = 0x0, i_crap = {ulr_count = 0,
     ulr_endoff = 0, ulr_diroff = 0, ulr_offset = 0, ulr_reclen = 0},
   i_crapcounter = 0, inode_ext = {lfs = 0xffff854afc30e038}, i_mode = 33152,
   i_nlink = 1, i_size = 32980992, i_flags = 131072, i_gen = 1, i_uid = 0,
   i_gid = 0, i_omode = 0, i_dirhash = 0x0, i_din = 0xffff854afbf4d038}
 (gdb) p/x $ip->i_lfs
 $9 = 0xffff854afa950000
 (gdb) p/x ((struct lfs *)0xffff854afa950000)->lfs_sp
 $10 = 0x0
 
 # fsck -n /lfs
 ** /dev/rdk3 (NO WRITE)
 ** Newer checkpoint verified; recovered 39 seconds of data
 ** Last Mounted on /lfs
 ** Phase 0 - Check Inode Free List
 ** Phase 1 - Check Blocks and Sizes
 ** Phase 2 - Check Pathnames
 ** Phase 3 - Check Connectivity
 ** Phase 4 - Check Reference Counts
 ** Phase 5 - Check Segment Block Accounting
 DMETA GIVEN AS 1424365, SHOULD BE 1424395
 
 FIX? no
 
 AVAIL GIVEN AS 2490250, SHOULD BE 2490130
 
 FIX? no
 
 1565695 files, 38944944 used, 4712836 free