netbsd boot error: assert failed: len <= map->dm_mapsize - offset (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 2db25c8bd775 Fix parser for carp state. The state values a..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1210c6f5c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=7fb1047f5dfa33b26331
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/55715852c5b5/disk-2db25c8b.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/8d9a9ff3d2d5/netbsd-2db25c8b.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7fb104...@syzkaller.appspotmail.com

[ 1.4299648] panic: kernel diagnostic assertion "len <= map->dm_mapsize - offset" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/arch/x86/x86/bus_dma.c", line 813 bad length 0x20004 + 4000 > 22000
[ 1.4299648] cpu0: Begin traceback...
[ 1.4299648] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 1.4299648] kern_assert() at netbsd:kern_assert+0x65 sys/arch/amd64/amd64/db_disasm.c:1074
[ 1.4299648] bus_dmamap_sync() at netbsd:bus_dmamap_sync+0x61a _bus_dmamap_sync sys/arch/x86/x86/bus_dma.c:813 [inline]
[ 1.4299648] bus_dmamap_sync() at netbsd:bus_dmamap_sync+0x61a sys/arch/x86/x86/bus_dma.c:1373
[ 1.4299648] virtio_enqueue_commit() at netbsd:virtio_enqueue_commit+0x506 sys/dev/pci/virtio.c:1174
[ 1.4299648] vioscsi_scsipi_request() at netbsd:vioscsi_scsipi_request+0xa3d sys/dev/pci/vioscsi.c:426
[ 1.4299648] scsipi_adapter_request() at netbsd:scsipi_adapter_request+0xd9 sys/dev/scsipi/scsipi_base.c:2834
[ 1.4299648] scsipi_run_queue() at netbsd:scsipi_run_queue+0x5ea sys/dev/scsipi/scsipi_base.c:2090
[ 1.4299648] scsipi_execute_xs() at netbsd:scsipi_execute_xs+0x7f2 sys/dev/scsipi/scsipi_base.c:2310
[ 1.4299648] scsipi_command() at netbsd:scsipi_command+0x1e6 sys/dev/scsipi/scsipiconf.c:107
[ 1.4299648] scsipi_inquire() at netbsd:scsipi_inquire+0x94 sys/dev/scsipi/scsipi_base.c:1221
[ 1.4299648] scsi_probe_bus() at netbsd:scsi_probe_bus+0x442 scsi_report_luns sys/dev/scsipi/scsiconf.c:358 [inline]
[ 1.4299648] scsi_probe_bus() at netbsd:scsi_probe_bus+0x442 scsi_discover_luns sys/dev/scsipi/scsiconf.c:435 [inline]
[ 1.4299648] scsi_probe_bus() at netbsd:scsi_probe_bus+0x442 sys/dev/scsipi/scsiconf.c:494
[ 1.4299648] scsibus_discover_thread() at netbsd:scsibus_discover_thread+0x110 scsibus_config sys/dev/scsipi/scsiconf.c:268 [inline]
[ 1.4299648] scsibus_discover_thread() at netbsd:scsibus_discover_thread+0x110 sys/dev/scsipi/scsiconf.c:233
[ 1.4299648] cpu0: End traceback...
[ 1.4299648] fatal breakpoint trap in supervisor mode
[ 1.4299648] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0 ilevel 0x8 rsp 0xffffbf022f8ea9f0
[ 1.4299648] curlwp 0xffffe772034a1b00 pid 0.96 lowest kstack 0xffffbf022f8e62c0
Stopped in pid 0.96 (system) at netbsd:breakpoint+0x5: leave
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
kern_assert() at netbsd:kern_assert+0x65 sys/arch/amd64/amd64/db_disasm.c:1074
bus_dmamap_sync() at netbsd:bus_dmamap_sync+0x61a _bus_dmamap_sync sys/arch/x86/x86/bus_dma.c:813 [inline]
bus_dmamap_sync() at netbsd:bus_dmamap_sync+0x61a sys/arch/x86/x86/bus_dma.c:1373
virtio_enqueue_commit() at netbsd:virtio_enqueue_commit+0x506 sys/dev/pci/virtio.c:1174
vioscsi_scsipi_request() at netbsd:vioscsi_scsipi_request+0xa3d sys/dev/pci/vioscsi.c:426
scsipi_adapter_request() at netbsd:scsipi_adapter_request+0xd9 sys/dev/scsipi/scsipi_base.c:2834
scsipi_run_queue() at netbsd:scsipi_run_queue+0x5ea sys/dev/scsipi/scsipi_base.c:2090
scsipi_execute_xs() at netbsd:scsipi_execute_xs+0x7f2 sys/dev/scsipi/scsipi_base.c:2310
scsipi_command() at netbsd:scsipi_command+0x1e6 sys/dev/scsipi/scsipiconf.c:107
scsipi_inquire() at netbsd:scsipi_inquire+0x94 sys/dev/scsipi/scsipi_base.c:1221
scsi_probe_bus() at netbsd:scsi_probe_bus+0x442 scsi_report_luns sys/dev/scsipi/scsiconf.c:358 [inline]
scsi_probe_bus() at netbsd:scsi_probe_bus+0x442 scsi_discover_luns sys/dev/scsipi/scsiconf.c:435 [inline]
scsi_probe_bus() at netbsd:scsi_probe_bus+0x442 sys/dev/scsipi/scsiconf.c:494
scsibus_discover_thread() at netbsd:scsibus_discover_thread+0x110 scsibus_config sys/dev/scsipi/scsiconf.c:268 [inline]
scsibus_discover_thread() at netbsd:scsibus_discover_thread+0x110 sys/dev/scsipi/scsiconf.c:233
ds 1
es a9b0
fs aa00
gs 10
rdi 5
rsi 0
rbp ffffbf022f8ea9f0
rbx 1
--db_more--


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to create VM pool: failed to create GCE image: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000bacaf0] Location: Message:Quota 'IMAGES' exceeded. Limit: 325.0 globally. ForceSendFields:[] NullFields:[]}.

syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs-2/netbsd/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs-2/netbsd/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs-2/netbsd/gopath/src/github.com/google/syzkaller/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1000784198=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at fc067f05b
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=netbsd GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=fc067f05bce8156101e90f93fe87e702114b863f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230328-180701'" "-tags=syz_target syz_os_netbsd syz_arch_amd64 " -o ./bin/netbsd_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=netbsd GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=fc067f05bce8156101e90f93fe87e702114b863f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230328-180701'" "-tags=syz_target syz_os_netbsd syz_arch_amd64 " -o ./bin/netbsd_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=netbsd GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=fc067f05bce8156101e90f93fe87e702114b863f -X 'github.com/google/syzkaller/prog.gitRevisionDate=20230328-180701'" "-tags=syz_target syz_os_netbsd syz_arch_amd64 " -o ./bin/netbsd_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/netbsd_amd64
/syzkaller/shared/netbsd/tools/bin/x86_64--netbsd-g++ -o ./bin/netbsd_amd64/syz-executor executor/executor.cc \
-m64 -static-pie --sysroot /syzkaller/shared/netbsd/dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -fpermissive -w -DGOOS_netbsd=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"fc067f05bce8156101e90f93fe87e702114b863f\"



Tested on:

commit: dc4b1713 s/ourput/output/ in comment.
git tree: https://github.com/NetBSD/src trunk
kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=7fb1047f5dfa33b26331
compiler: Debian clang version 15.0.7

Note: no patches were applied.

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to create VM pool: failed to create GCE image: create image operation failed: &{Code:QUOTA_EXCEEDED ErrorDetails:[0xc000628640] Location: Message:Quota 'IMAGES' exceeded. Limit: 325.0 globally. ForceSendFields:[] NullFields:[]}.

syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""

GOMODCACHE="/syzkaller/jobs/netbsd/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/netbsd/gopath"

GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"

GOMOD="/syzkaller/jobs/netbsd/gopath/src/github.com/google/syzkaller/go.mod"

GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"

GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1465010123=/tmp/go-build -gno-record-gcc-switches"

patch: https://syzkaller.appspot.com/x/patch.diff?x=153296cdc80000

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+7fb104...@syzkaller.appspotmail.com

Tested on:

commit: dc4b1713 s/ourput/output/ in comment.
git tree: https://github.com/NetBSD/src trunk
kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=7fb1047f5dfa33b26331
compiler: Debian clang version 15.0.7

patch: https://syzkaller.appspot.com/x/patch.diff?x=11e68835c80000

Note: testing is done by a robot and is best-effort only.