Subject: Re: kern/59663

["Henryk Paluch via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/59663; it has been noted by GNATS.

From: "Henryk Paluch" <hpaluch%seznam.cz@localhost>
To: <gnats-bugs%NetBSD.org@localhost>
Cc: 
Subject: Subject: Re: kern/59663
Date: Tue, 23 Sep 2025 19:50:35 +0200 (CEST)

 I found reliable way how to crash above "NetBSD 11.0_BETA (GENERIC) #0: Tu=
 e Sep 16 04:05:29 UTC 2025" in *few seconds*.
 
 Just these 2 commands are enough (reproducible on both VMD and bare metal)=
 :
 
 nbsd11-test3# fssconfig -cx fss0 / /root/backup
 nbsd11-test3# dd if=3D/dev/fss0 of=3D/dev/null bs=3D1024k
 
 After few seconds:
 
 [  58.8640367] panic: kernel diagnostic assertion "(i * BITMAP_SIZE) < pp-=
 >pr_itemsperpage" failed: file "/usr/src/sys/kern/subr_pool.c", line 450 =
 
 [  58.8640367] cpu0: Begin traceback...
 [  58.8741603] vpanic() at netbsd:vpanic+0x171
 [  58.8741603] kern_assert() at netbsd:kern_assert+0x4b
 [  58.8741603] pool_get() at netbsd:pool_get+0x46b
 [  58.8741603] allocbuf() at netbsd:allocbuf+0x113
 [  58.8741603] getblk() at netbsd:getblk+0x18c
 [  58.8741603] bio_doread() at netbsd:bio_doread+0x1d
 [  58.8842815] breadn() at netbsd:breadn+0x24
 [  58.8842815] ffs_snapshot_read() at netbsd:ffs_snapshot_read+0x1b2
 [  58.8842815] VOP_READ() at netbsd:VOP_READ+0x42
 [  58.8842815] vn_rdwr() at netbsd:vn_rdwr+0xf1
 [  58.8842815] fss_bs_io() at netbsd:fss_bs_io+0x89
 [  58.8842815] fss_bs_thread() at netbsd:fss_bs_thread+0x50f
 [  58.8842815] cpu0: End traceback...
 [  58.8842815] fatal breakpoint trap in supervisor mode
 [  58.8842815] trap type 1 code 0 rip 0xffffffff8023541d cs 0x8 rflags 0x2=
 02 cr2 0xffff8f026ade5000 ilevel 0 rsp 0xffff8f0277ef7b70
 [  58.8955114] curlwp 0xffff8889b54f7800 pid 0.1426 lowest kstack 0xffff8f=
 0277ef32c0
 Stopped in pid 0.1426 (system) at       netbsd:breakpoint+0x5:  leave
 breakpoint() at netbsd:breakpoint+0x5
 vpanic() at netbsd:vpanic+0x171
 kern_assert() at netbsd:kern_assert+0x4b
 pool_get() at netbsd:pool_get+0x46b
 allocbuf() at netbsd:allocbuf+0x113
 getblk() at netbsd:getblk+0x18c
 bio_doread() at netbsd:bio_doread+0x1d
 breadn() at netbsd:breadn+0x24
 ffs_snapshot_read() at netbsd:ffs_snapshot_read+0x1b2
 VOP_READ() at netbsd:VOP_READ+0x42
 vn_rdwr() at netbsd:vn_rdwr+0xf1
 fss_bs_io() at netbsd:fss_bs_io+0x89
 fss_bs_thread() at netbsd:fss_bs_thread+0x50f
 ds          0
 es          0
 fs          180
 gs          7b20
 rdi         0
 rsi         3f8
 rbp         ffff8f0277ef7b70
 rbx         ffffffff8142a670    ostype+0x7867e
 rdx         1
 --db_more--rcx         ffffffffffffff
 rax         800000000000000
 r8          0
 r9          0
 r10         0
 r11         0
 r12         ffff8f0277ef7bb8
 r13         104
 r14         1
 r15         ffff8f02670b0000
 rip         ffffffff8023541d    breakpoint+0x5
 cs          8
 rflags      202
 rsp         ffff8f0277ef7b70
 ss          10
 netbsd:breakpoint+0x5:  leave
 db{0}> bt
 breakpoint() at netbsd:breakpoint+0x5
 vpanic() at netbsd:vpanic+0x171
 kern_assert() at netbsd:kern_assert+0x4b
 pool_get() at netbsd:pool_get+0x46b
 allocbuf() at netbsd:allocbuf+0x113
 getblk() at netbsd:getblk+0x18c
 bio_doread() at netbsd:bio_doread+0x1d
 breadn() at netbsd:breadn+0x24
 ffs_snapshot_read() at netbsd:ffs_snapshot_read+0x1b2
 VOP_READ() at netbsd:VOP_READ+0x42
 vn_rdwr() at netbsd:vn_rdwr+0xf1
 fss_bs_io() at netbsd:fss_bs_io+0x89
 fss_bs_thread() at netbsd:fss_bs_thread+0x50f