kern/55744: 9.0 kernel panics from pcictl command by normal user

[reinoud%13thmonkey.org@localhost]

>Number:         55744
>Category:       kern
>Synopsis:       9.0 kernel panics from pcictl command by normal user
>Confidential:   yes
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 21 21:35:00 +0000 2020
>Originator:     Reinoud Zandijk
>Release:        NetBSD 9.0_STABLE
>Organization:
NetBSD
	
>Environment:
	
	
System: NetBSD diablo.13thmonkey.org 9.0_STABLE NetBSD 9.0_STABLE (GENERIC) #0: Sun Oct 4 18:24:07 UTC 2020 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
The kernel panics when I issue `pcictl pci0 list -N' on this machine. Without
the -N it works fine and prints:

> pcictl pci0 list
000:00:0: Intel X58 Host (host bridge, revision 0x13)
000:01:0: Intel 5520/5500/X58 PCIe Root Port 1 (PCI bridge, revision 0x13)
000:03:0: Intel 5520/5500/X58 PCIe Root Port 3 (PCI bridge, revision 0x13)
000:07:0: Intel 5520/5500/X58 PCIe Root Port 7 (PCI bridge, revision 0x13)
000:20:0: Intel 5520/5500/X58 Misc (interrupt system, generic 8259, revision
0x13)
000:20:1: Intel 5520/5500/X58 Scratchpads and GPIO (interrupt system, generic
8259, revision 0x13)
000:20:2: Intel 5520/5500/X58 Control Status and RAS (interrupt system,
generic 8259, revision 0x13)
000:20:3: Intel 5520/5500/X58 Throttling (interrupt system, generic 8259,
revision 0x13)
000:26:0: Intel 82801JI USB UHCI Controller (USB serial bus, UHCI)
000:26:1: Intel 82801JI USB UHCI Controller (USB serial bus, UHCI)
000:26:2: Intel 82801JI USB UHCI Controller (USB serial bus, UHCI)
000:26:7: Intel 82801JI USB EHCI Controller (USB serial bus, EHCI)
000:27:0: Intel 82801JI High Definition Audio Controller (mixed mode
multimedia)
000:28:0: Intel 82801JI PCI Express Port (PCI bridge)
000:28:2: Intel 82801JI PCI Express Port (PCI bridge)
000:28:4: Intel 82801JI PCI Express Port (PCI bridge)
000:28:5: Intel 82801JI PCI Express Port (PCI bridge)
000:29:0: Intel 82801JI USB UHCI Controller (USB serial bus, UHCI)
000:29:1: Intel 82801JI USB UHCI Controller (USB serial bus, UHCI)
000:29:2: Intel 82801JI USB UHCI Controller (USB serial bus, UHCI)
000:29:7: Intel 82801JI USB EHCI Controller (USB serial bus, EHCI)
000:30:0: Intel 82801BA Hub-PCI Bridge (PCI bridge, subtractive decode,
revision 0x90)
000:31:0: Intel 82801JIR LPC Interface Bridge (ISA bridge)
000:31:2: Intel 82801JI SATA Controller (AHCI mode) (SATA mass storage, AHCI
1.0)
000:31:3: Intel 82801JI SMBus Controller (SMBus serial bus)
002:00:0: ATI Technologies Radeon HD 5450 (VGA display)
002:00:1: ATI Technologies Radeon HD 5400/6300/7300 HD Audio Controller (mixed
mode multimedia)
004:00:0: Marvell Yukon 88E8056 (ethernet network, revision 0x12)
005:00:0: Marvell 88SE6121 SATA II Controller (IDE mass storage, interface
0x8f, revision 0xb2)
006:00:0: Marvell Yukon 88E8056 (ethernet network, revision 0x12)
008:01:0: PLX Technology PEX 8112 PCIe-to-PCI Bridge (PCI bridge, revision
0xaa)
008:02:0: VIA Technologies VT6306 IEEE 1394 Host Controller (IEEE1394 serial
bus, OpenHCI, revision 0xc0)
009:00:0: ATI Technologies product 68e1 (VGA display)
009:00:1: ATI Technologies Radeon HD 5400/6300/7300 HD Audio Controller (mixed
mode multimedia)
255:00:0: Intel product 2c41 (host bridge, revision 0x05)
255:00:1: Intel QuickPath System Address Decoder (host bridge, revision 0x05)
255:02:0: Intel Xeon 5500 QPI Link 0 (host bridge, revision 0x05)
255:02:1: Intel Xeon 5500 QPI Physical 0 (host bridge, revision 0x05)
255:03:0: Intel Xeon 5500 IMC (host bridge, revision 0x05)
255:03:1: Intel Xeon 5500 IMC Target Address Decoder (host bridge, revision
0x05)
255:03:4: Intel Xeon 5500 IMC Test (host bridge, revision 0x05)
255:04:0: Intel Xeon 5500 IMC Channel 0 Control (host bridge, revision 0x05)
255:04:1: Intel Xeon 5500 IMC Channel 0 Address (host bridge, revision 0x05)
255:04:2: Intel Xeon 5500 IMC Channel 0 Rank (host bridge, revision 0x05)
255:04:3: Intel Xeon 5500 IMC Channel 0 Thermal Control (host bridge, revision
0x05)
255:05:0: Intel Xeon 5500 IMC Channel 1 Control (host bridge, revision 0x05)
255:05:1: Intel Xeon 5500 IMC Channel 1 Address (host bridge, revision 0x05)
255:05:2: Intel Xeon 5500 IMC Channel 1 Rank (host bridge, revision 0x05)
255:05:3: Intel Xeon 5500 IMC Channel 1 Thermal Control (host bridge, revision
0x05)
255:06:0: Intel Xeon 5500 IMC Channel 2 Control (host bridge, revision 0x05)
255:06:1: Intel Xeon 5500 IMC Channel 2 Address (host bridge, revision 0x05)
255:06:2: Intel Xeon 5500 IMC Channel 2 Rank (host bridge, revision 0x05)
255:06:3: Intel Xeon 5500 IMC Channel 2 Thermal Control (host bridge, revision
0x05)

When printing with -N the last one printed before the panic is the 009:00:1
line.

I don't have the gdb kernel around but the stacktrace i could get is:
#4  0xffffffff8021d56b in alltraps ()
#5  0xffffffff802923b5 in pciioctl ()
#6  0xffffffff80983efd in cdev_ioctl ()
#7  0xffffffff80974ab6 in tc_windup ()
#8  0xffffffff809eca4e in VOP_IOCTL ()
#9  0xffffffff809e621f in vn_ioctl ()
#10 0xffffffff8099de88 in sys_ioctl ()
#11 0xffffffff8024c177 in syscall ()
#12 0xffffffff802096dd in handle_syscall ()

	
>How-To-Repeat:
Issue the command `pcictl pci0 list -N' on this machine.

	
>Fix:
	
Probably an out of array adressing to fix.

>Unformatted: