netbsd test error: UBSan: Undefined Behavior in uvm_map_lookup_entry

[syzbot <syzbot+d3c99e0eaf41f7f17756%syzkaller.appspotmail.com@localhost>]

Hello,

syzbot found the following issue on:

HEAD commit:    4561671c22f3 uvm_map(9): Sprinkle invariant assertions int..
git tree:       netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1115e6cb980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=d3c99e0eaf41f7f17756
compiler:       g++ (Debian 12.2.0-14) 12.2.0

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a03975b44f25/disk-4561671c.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/90f576fa760b/netbsd-4561671c.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3c99e0eaf41f7f17756%syzkaller.appspotmail.com@localhost

[   1.0000000] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/uvm/uvm_map.c:1668:4, member access within null pointer of type 'struct vm_map_entry'

[   1.0000000] cpu0: Begin traceback...
[   1.0000000] vpanic() at netbsd:vpanic+0x2f3 sys/kern/subr_prf.c:288
[   1.0000000] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[   1.0000000] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1f9 sys/../common/lib/libc/misc/ubsan.c:429
[   1.0000000] uvm_map_lookup_entry() at netbsd:uvm_map_lookup_entry+0xa81 uvm_map_lookup_entry_bytree sys/uvm/uvm_map.c:1668 [inline]
[   1.0000000] uvm_map_lookup_entry() at netbsd:uvm_map_lookup_entry+0xa81 sys/uvm/uvm_map.c:1731
[   1.0000000] uvm_map_findspace() at netbsd:uvm_map_findspace+0x351 sys/uvm/uvm_map.c:2004
[   1.0000000] uvm_map_prepare() at netbsd:uvm_map_prepare+0x563 sys/uvm/uvm_map.c:1185
[   1.0000000] uvm_km_bootstrap() at netbsd:uvm_km_bootstrap+0xfa sys/uvm/uvm_km.c:317
[   1.0000000] uvm_init() at netbsd:uvm_init+0x83 sys/uvm/uvm_init.c:135
[   1.0000000] main() at netbsd:main+0x135 sys/kern/init_main.c:318
[   1.0000000] cpu0: End traceback...
[   1.0000000] fatal breakpoint trap in supervisor mode
[   1.0000000] trap type 1 code 0 rip 0xffffffff8023547d cs 0x8 rflags 0x202 cr2 0 ilevel 0x8 rsp 0xffffffff870b3680
[   1.0000000] curlwp 0xffffffff867f11c0 pid 0.0 lowest kstack 0xffffffff870ae2c0
Stopped in pid 0.0 (system) at  netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:71
vpanic() at netbsd:vpanic+0x2f3 sys/kern/subr_prf.c:288
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1f9 sys/../common/lib/libc/misc/ubsan.c:429
uvm_map_lookup_entry() at netbsd:uvm_map_lookup_entry+0xa81 uvm_map_lookup_entry_bytree sys/uvm/uvm_map.c:1668 [inline]
uvm_map_lookup_entry() at netbsd:uvm_map_lookup_entry+0xa81 sys/uvm/uvm_map.c:1731
uvm_map_findspace() at netbsd:uvm_map_findspace+0x351 sys/uvm/uvm_map.c:2004
uvm_map_prepare() at netbsd:uvm_map_prepare+0x563 sys/uvm/uvm_map.c:1185
uvm_km_bootstrap() at netbsd:uvm_km_bootstrap+0xfa sys/uvm/uvm_km.c:317
uvm_init() at netbsd:uvm_init+0x83 sys/uvm/uvm_init.c:135
main() at netbsd:main+0x135 sys/kern/init_main.c:318
ds          36f8
es          3640
fs          3690
gs          10
rdi         5
rsi         0
rbp         ffffffff870b3680
rbx         1
rdx         1
rcx         ffffffff82c517ce    db_panic+0xde
rax         17
--db_more--

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller%googlegroups.com@localhost.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

-- 
You received this message because you are subscribed to the Google Groups "syzkaller-netbsd-bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-netbsd-bugs+unsubscribe%googlegroups.com@localhost.
To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-netbsd-bugs/000000000000dede2b061f97c3da%40google.com.