Re: kern/60305: panic in AIO

["Harold Gutch via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/60305; it has been noted by GNATS.

From: Harold Gutch <logix%foobar.franken.de@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/60305: panic in AIO
Date: Tue, 2 Jun 2026 12:25:07 +0200

 --3XA6nns4nE4KvaS/
 Content-Type: text/plain; charset=us-ascii
 Content-Disposition: inline
 
 riastradh@ reduced the test case to the attached code.  It panics in
 the aio_read(), so for an absolutely *minimal* reproducer that is all
 that is needed.
 
 This panics the same way a vanilly amd64 current - tested as an
 unprivileged user in an amd64 live image running on a VM.
 
 --3XA6nns4nE4KvaS/
 Content-Type: text/x-csrc; charset=us-ascii
 Content-Disposition: attachment; filename="aionull.c"
 
 #include <aio.h>
 #include <err.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
 
 int
 main(void)
 {
 	char buf;
 	struct aiocb aio = {
 		.aio_offset = 0,
 		.aio_buf = &buf,
 		.aio_nbytes = 1,
 		.aio_fildes = -1,
 	};
 	ssize_t nread;
 
 	aio.aio_fildes = open("/dev/null", O_RDONLY);
 	if (aio.aio_fildes == -1)
 		err(EXIT_FAILURE, "open /dev/null");
 	if (aio_read(&aio) == -1)
 		err(EXIT_FAILURE, "aio_read");
 	if (aio_suspend((const struct aiocb *[]){&aio}, 1, NULL) == -1)
 		err(EXIT_FAILURE, "aio_suspend");
 	if (aio_error(&aio) == -1)
 		err(EXIT_FAILURE, "aio_error");
 	nread = aio_return(&aio);
 	if (nread == -1)
 		err(EXIT_FAILURE, "aio_return");
 	printf("read %zu byte%s\n", (size_t)nread, nread == 1 ? "" : "s");
 	return 0;
 }
 
 --3XA6nns4nE4KvaS/--