NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/56454: kevent tests crash the kernel if run under compat_netbsd32



>Number:         56454
>Category:       kern
>Synopsis:       kevent tests crash the kernel if run under compat_netbsd32
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 14 21:20:01 +0000 2021
>Originator:     Martin Husemann
>Release:        NetBSD 9.99.91
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD seven-days-to-the-wolves.aprisoft.de 9.99.91 NetBSD 9.99.91 (GENERIC) #488: Thu Oct 14 14:50:00 CEST 2021 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

Running the i386 tests under compat_netbsd32 on an amd46 host crashes the
kernel:

db{1}> show panic
Panic string: kernel diagnostic assertion "u64 == (uintptr_t)(NETBSD32_POINTER_T
YPE)u64" failed: file "../../../../compat/netbsd32/netbsd32.h", line 135 u64 fff
fef414a4fc340 != 4a4fc340
db{1}> bt
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x156
__x86_indirect_thunk_rax() at netbsd:__x86_indirect_thunk_rax
netbsd32_kevent_put_events() at netbsd:netbsd32_kevent_put_events+-0x1194c
kevent1() at netbsd:kevent1+0x121a
netbsd32___kevent50() at netbsd:netbsd32___kevent50+0x77
netbsd32_syscall() at netbsd:netbsd32_syscall+-0x207a5b

(gdb) list *(netbsd32_kevent_put_events+-0x1194c)
0xffffffff8043b493 is in netbsd32_kevent_put_events (../../../../compat/netbsd32/netbsd32.h:135).
130     
131     static __inline NETBSD32_POINTER_TYPE
132     netbsd32_ptr32i(const void *p64)
133     {
134             uintptr_t u64 = (uintptr_t)p64;
135             KASSERTMSG(u64 == (uintptr_t)(NETBSD32_POINTER_TYPE)u64,
136                 "u64 %jx != %jx", (uintmax_t)u64,
137                (uintmax_t)(NETBSD32_POINTER_TYPE)u64);
138             return u64;
139     }
0xffffffff80ce305e is in kevent1 (../../../../kern/kern_event.c:2243).
2238            mutex_exit(&fdp->fd_lock);
2239    
2240    done:
2241            if (nkev != 0) {
2242                    /* copyout remaining events */
2243                    error = (*keops->keo_put_events)(keops->keo_private,
2244                        kevbuf, ulistp, nevents, nkev);
2245            }
2246            *retval = maxevents - count;
2247    


>How-To-Repeat:
s/a

>Fix:
n/a



Home | Main Index | Thread Index | Old Index