kern/60893: compat_linux inotify: find_entry() returns -1, handle_write() indexes ide_entries[-1], kernel panic

["alnsn%NetBSD.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60893
>Category:       kern
>Synopsis:       compat_linux inotify: find_entry() returns -1, handle_write() indexes ide_entries[-1], kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Oct 17 12:45:00 +0000 2026
>Originator:     Alexander Nasonov
>Release:        NetBSD 11.0_STABLE (netbsd-11), amd64
>Organization:
	home, sweet home
>Environment:
NetBSD 11.0_STABLE amd64, compat_linux loaded (module).  The KASSERT in
find_entry() did not fire, so the module was evidently built without
DIAGNOSTIC.  sys/compat/linux/common/linux_inotify.c is v1.8 on
netbsd-11; trunk (v1.11, 2026/09/20) has the same find_entry() and
handle_write().

>Description:
*** This PR was prepared by Claude (Anthropic's AI assistant, Claude Code
*** CLI) running on the reporter's NetBSD machine, from a kernel crash
*** dump and the source in /usr/src.  The reporter, Alexander Nasonov,
*** is submitting it.  The analysis has not been independently reviewed.

Running the native Linux x64 Claude Code CLI (a Bun binary, uses inotify)
under compat_linux panicked the kernel:

  uvm_fault(0xffffffff818f2220, 0xffff82810db99000, 1) -> e
  fatal page fault in supervisor mode
  trap type 6 code 0 rip 0xffffffff80e61fa0 ... cr2 0xffff82810db99e00
  curlwp ... pid 12428.12434
  panic: trap

  strlen <- do_kevent_to_inotify <- inotify_filt_event <- knote <-
  VOP_CREATE <- vn_open <- do_open <- do_sys_openat <- linux_sys_openat

i.e. an openat(O_CREAT) in a watched directory.

>How-To-Repeat:
Build the program below on Linux (or with a Linux compiler under
compat_linux) and run it under compat_linux.  It creates a directory
under the given path, watches it with inotify, and creates files in it.
Running it crashed the machine:

$ ./inotify-panic /var/shm
creating /var/shm/inotify312xWN/f0
creating /var/shm/inotify312xWN/f1

--- inotify-panic.c ---
#include <sys/inotify.h>
#include <fcntl.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int
main(int argc, char **argv)
{
	char dir[PATH_MAX];
	char path[PATH_MAX + 32];
	const char *base = argc > 1 ? argv[1] : "/tmp";
	int ifd, fd, i;

	setvbuf(stdout, NULL, _IONBF, 0);

	snprintf(dir, sizeof(dir), "%s/inotifyXXXXXX", base);
	if (mkdtemp(dir) == NULL) {
		perror("mkdtemp");
		return 1;
	}

	for (i = 0; i < 4; i++) {
		snprintf(path, sizeof(path), "%s/pre%d", dir, i);
		fd = open(path, O_CREAT | O_WRONLY, 0600);
		if (fd < 0) {
			perror("open");
			return 1;
		}
		close(fd);
	}

	ifd = inotify_init1(0);
	if (ifd < 0) {
		perror("inotify_init1");
		return 1;
	}
	if (inotify_add_watch(ifd, dir, IN_CREATE | IN_DELETE) < 0) {
		perror("inotify_add_watch");
		return 1;
	}

	for (i = 0; i < 1000; i++) {
		snprintf(path, sizeof(path), "%s/f%d", dir, i);
		printf("creating %s\n", path);
		fd = open(path, O_CREAT | O_WRONLY, 0600);
		if (fd < 0) {
			perror("open");
			return 1;
		}
		close(fd);
	}

	puts("no panic");
	return 0;
}
--- end ---

>Fix:
No patch (project policy on LLM-generated code).