netbsd boot error: page fault in virtio_free_vq

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: b96529fbe61a entropy(7): Omit needless offset for diagnost..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11548536c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=f79e99ac21cb702c2581
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7dbab720cc83/disk-b96529fb.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/76595dd71115/netbsd-b96529fb.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f79e99...@syzkaller.appspotmail.com

[ 1.0101969] fatal page fault in supervisor mode
[ 1.0101969] trap type 6 code 0 rip 0xffffffff83db4199 cs 0x8 rflags 0x10246 cr2 0xffffaa8010b20000 ilevel 0x8 rsp 0xffffffff870a93b0
[ 1.0101969] curlwp 0xffffffff86742ac0 pid 0.0 lowest kstack 0xffffffff870a42c0
kernel: page fault trap, code=0
Stopped in pid 0.0 (system) at netbsd:virtio_free_vq+0x7d: movq 0(%r12),
%r12
virtio_free_vq() at netbsd:virtio_free_vq+0x7d sys/dev/pci/virtio.c:903
vioscsi_attach() at netbsd:vioscsi_attach+0x959 sys/dev/pci/vioscsi.c:210
config_attach_internal() at netbsd:config_attach_internal+0x4d6 sys/kern/subr_autoconf.c:1785
config_found() at netbsd:config_found+0x354 sys/kern/subr_autoconf.c:1272
virtio_pci_rescan() at netbsd:virtio_pci_rescan+0x8e sys/dev/pci/virtio_pci.c:318
virtio_pci_attach() at netbsd:virtio_pci_attach+0x459 sys/dev/pci/virtio_pci.c:299
config_attach_internal() at netbsd:config_attach_internal+0x4d6 sys/kern/subr_autoconf.c:1785
config_found() at netbsd:config_found+0x354 sys/kern/subr_autoconf.c:1272
pci_probe_device() at netbsd:pci_probe_device+0xec9 sys/dev/pci/pci.c:488
pci_enumerate_bus() at netbsd:pci_enumerate_bus+0x481 sys/dev/pci/pci.c:819
pcirescan() at netbsd:pcirescan+0x75 sys/dev/pci/pci.c:113
pciattach() at netbsd:pciattach+0x50f sys/dev/pci/pci.c:210
config_attach_internal() at netbsd:config_attach_internal+0x4d6 sys/kern/subr_autoconf.c:1785
config_found() at netbsd:config_found+0x354 sys/kern/subr_autoconf.c:1272
mp_pci_scan() at netbsd:mp_pci_scan+0x1d6 sys/arch/x86/x86/mp.c:96
amd64_mainbus_attach() at netbsd:amd64_mainbus_attach+0x467 sys/arch/amd64/amd64/amd64_mainbus.c:213
config_attach_internal() at netbsd:config_attach_internal+0x4d6 sys/kern/subr_autoconf.c:1785
config_rootfound() at netbsd:config_rootfound+0x92 config_attach sys/kern/subr_autoconf.c:1820 [inline]
config_rootfound() at netbsd:config_rootfound+0x92 sys/kern/subr_autoconf.c:1300
cpu_configure() at netbsd:cpu_configure+0x58 sys/arch/amd64/amd64/autoconf.c:112
main() at netbsd:main+0x452 sys/kern/init_main.c:555
--db_more--


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Shoichi Yamaguchi]

#syz fix: Added check of pointer for allocated memory before release of resource

https://syzkaller.appspot.com/bug?id=818d68586fc33300f142a496d43ee4a2ede3954d
https://mail-index.netbsd.org/source-changes/2023/03/24/msg143844.html