kern/60534: NULL deref in async IO code during ATF test run

["martin%NetBSD.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60534
>Category:       kern
>Synopsis:       NULL deref in async IO code during ATF test run
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 03 12:55:00 +0000 2026
>Originator:     Martin Husemann
>Release:        NetBSD 11.99.7
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD big-apple.aprisoft.de 11.99.7 NetBSD 11.99.7 (POWERMAC_G5.MP) #161: Tue Jul 14 16:42:13 CEST 2026 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/macppc/compile/POWERMAC_G5.MP macppc
Architecture: powerpc
Machine: macppc
>Description:

During an ATF test run, while doing the async IO tests, my kernel crashed:

[ 5154.8862761] cpu0: data fault: pc=1664e10 rpc=107786e8b addr=0
[ 5154.8862761] kernel trap 30: data access exception
Stopped in pid 13719.13719 (t_aio_suspend) at   netbsd:aiosp_validate_conflicts+
0x70:   ldx             [%o0 + 0x38], %g1
db{0}> sh reg
tstate      4482000604
pc          1664e10     aiosp_validate_conflicts+0x70
npc         1664e14     aiosp_validate_conflicts+0x74
ipl         0
y           0
g0          0
g1          0
g2          4000
g3          ffffffffffffd1a8
g4          ffffffffffffc851
g5          0
g6          996671fcafe93e33
g7          4021a890
o0          0
o1          0
o2          0
o3          0
o4          0
o5          0
o6          2531e3271
o7          1664e04     aiosp_validate_conflicts+0x64
l0          ffffffff00000000

This is at:

0x1664e10 is in aiosp_validate_conflicts (../../../../kern/sys_aio.c:1148).
1143                    if (job && st->job->aiocb_uptr == uptr) {
1144                            mutex_exit(&aiosp->mtx);
1145                            return EINVAL;
1146                    } else if (st->fg) {
1147                            mutex_enter(&st->fg->mtx);
1148 >>>                        TAILQ_FOREACH(job, &st->fg->queue, list) {
1149                                    if (job->aiocb_uptr == uptr) {
1150                                            mutex_exit(&st->fg->mtx);
1151                                            mutex_exit(&aiosp->mtx);
1152                                            return EINVAL;



>How-To-Repeat:
not sure yet, will retry to see if it is reproducable

>Fix:
n/a