netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:LINE, me

Status: fixed on 2019/11/17 08:54
Reported-by: syzbot+77097fae0e3aad6de088@syzkaller.appspotmail.com
Fix commit: 41eeee0166bf Get &rsc->sc_dksc only when we know 'rsc' is not NULL. This was actually harmless because we didn't use the pointer then.
First crash: 2522d, last: 2518d

Sample crash report:
[   1.4369718] panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:521:7, member access within null pointer of type 'struct raid_softc'

[   1.4544374] cpu0: Begin traceback...
[   1.4570449] vpanic() at netbsd:vpanic+0x258 sys/kern/subr_prf.c:336
[   1.4670136] isAlreadyReported() at netbsd:isAlreadyReported
[   1.4770275] HandleTypeMismatch() at netbsd:HandleTypeMismatch
[   1.4970562] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x7b sys/../common/lib/libc/misc/ubsan.c:396
[   1.5070718] rf_buildroothack() at netbsd:rf_buildroothack+0x4c3 sys/dev/raidframe/rf_netbsdkintf.c:526
[   1.5170842] rf_autoconfig() at netbsd:rf_autoconfig+0x75 rf_autoconfig sys/dev/raidframe/rf_netbsdkintf.c:432 [inline]
[   1.5170842] rf_autoconfig() at netbsd:rf_autoconfig+0x75 sys/dev/raidframe/rf_netbsdkintf.c:400
[   1.5270987] config_finalize() at netbsd:config_finalize+0x13d sys/kern/subr_autoconf.c:2148
[   1.5471290] main() at netbsd:main+0x594 sys/kern/init_main.c:647
[   1.5471290] cpu0: End traceback...
[   1.5471290] fatal breakpoint trap in supervisor mode
[   1.5575433] trap type 1 code 0 rip 0xffffffff8021dddd cs 0x8 rflags 0x282 cr2 0 ilevel 0 rsp 0xffffffff85e1d7d0
[   1.5575433] curlwp 0xffffffff84bb3f00 pid 0.1 lowest kstack 0xffffffff85e192c0
Stopped in pid 0.1 (system) at  netbsd:breakpoint+0x5:  leave
db{0}>

Crashes (114):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/29 15:00 netbsd 6a74a23f6c2b 5ea87a66 .config console log report ci2-netbsd-kubsan
2019/10/29 12:50 netbsd b3b1bbfea2ac 5ea87a66 .config console log report ci2-netbsd-kubsan
2019/10/29 10:21 netbsd b7acf46b11d7 5ea87a66 .config console log report ci2-netbsd-kubsan
2019/10/29 08:31 netbsd ba8ef82103a3 5ea87a66 .config console log report ci2-netbsd-kubsan
2019/10/29 06:41 netbsd 35c50d38e3d3 5ea87a66 .config console log report ci2-netbsd-kubsan
2019/10/29 06:41 netbsd 35c50d38e3d3 5ea87a66 .config console log report ci2-netbsd-kubsan
2019/10/29 04:21 netbsd 05afaedcb586 5ea87a66 .config console log report ci2-netbsd-kubsan
2019/10/29 02:08 netbsd 05afaedcb586 439d7b14 .config console log report ci2-netbsd-kubsan
2019/10/29 00:39 netbsd bdc2d66f10a6 439d7b14 .config console log report ci2-netbsd-kubsan
2019/10/28 20:49 netbsd 88684cc12fcd 439d7b14 .config console log report ci2-netbsd-kubsan
2019/10/28 18:18 netbsd 34ba4cf7486d 439d7b14 .config console log report ci2-netbsd-kubsan
2019/10/28 16:49 netbsd 2009b3445b28 439d7b14 .config console log report ci2-netbsd-kubsan
2019/10/28 16:19 netbsd e933eb9bcea7 439d7b14 .config console log report ci2-netbsd-kubsan
2019/10/28 14:43 netbsd e933eb9bcea7 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/28 12:25 netbsd 97f6efe30ec7 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/28 10:33 netbsd c0b3436e2978 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/28 08:43 netbsd 382bb6d0521f 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/28 05:12 netbsd 506b766c78bd 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/28 02:22 netbsd ebfc3a27e8ec 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/28 00:52 netbsd 0891609ab9e4 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 23:02 netbsd f78658c676e7 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 21:32 netbsd 3b7f58a93e7c 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 19:42 netbsd 1a26d940fa96 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 17:52 netbsd d4bd146870b0 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 14:42 netbsd 9c400ce1f105 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 14:42 netbsd 9c400ce1f105 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 12:32 netbsd 1a2e98b20435 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 12:32 netbsd 1a2e98b20435 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 12:32 netbsd 1a2e98b20435 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 10:42 netbsd 33a091780cd4 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 10:42 netbsd 33a091780cd4 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 10:42 netbsd 33a091780cd4 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 09:12 netbsd d6f1671c0df0 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 09:12 netbsd d6f1671c0df0 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 09:12 netbsd d6f1671c0df0 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 04:22 netbsd c951ead6dfa8 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 04:22 netbsd c951ead6dfa8 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 04:22 netbsd c951ead6dfa8 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 01:13 netbsd 384577c37e51 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 01:13 netbsd 384577c37e51 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/27 01:13 netbsd 384577c37e51 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/26 20:42 netbsd 26bfef2dca21 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/26 20:42 netbsd 26bfef2dca21 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/26 20:42 netbsd 26bfef2dca21 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/26 18:52 netbsd b4f08fda10d4 25bb509e .config console log report ci2-netbsd-kubsan
2019/10/25 23:59 netbsd 320188d70966 413926c5 .config console log report ci2-netbsd-kubsan
* Struck through repros no longer work on HEAD.