netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/crypto/nist_hash_drbg/nist_hash_drbg.c:

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: e727c90e Handle M_EXT with M_BUFADDR, and introduce M_BUFS..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1524c2ad600000
kernel config: https://syzkaller.appspot.com/x/.config?x=824b23e1f4b6c76b
dashboard link: https://syzkaller.appspot.com/bug?extid=fa6b829ea0f49393a7fe

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+fa6b82...@syzkaller.appspotmail.com

[ 1.0000000] panic: UBSan: Undefined Behavior in
/syzkaller/managers/netbsd-kubsan/kernel/sys/crypto/nist_hash_drbg/nist_hash_drbg.c:1090:4,
variable length array bound value -1 <= 0

[ 1.0000000] cpu0: Begin traceback...
[ 1.0000000] vpanic() at netbsd:vpanic+0x258 sys/kern/subr_prf.c:336
[ 1.0000000] isAlreadyReported() at netbsd:isAlreadyReported
[ 1.0000000] HandleVlaBoundNotPositive() at
netbsd:HandleVlaBoundNotPositive+0xed
sys/../common/lib/libc/misc/ubsan.c:431
[ 1.0000000] nist_sha256_hash_drbg_initialize() at
netbsd:nist_sha256_hash_drbg_initialize+0x1030
sys/crypto/nist_hash_drbg/nist_hash_drbg.c:1090
[ 1.0000000] cprng_init() at netbsd:cprng_init+0x12
sys/kern/subr_cprng.c:80
[ 1.0000000] main() at netbsd:main+0x18a sys/kern/init_main.c:394
[ 1.0000000] cpu0: End traceback...
[ 1.0000000] fatal breakpoint trap in supervisor mode
[ 1.0000000] trap type 1 code 0 rip 0xffffffff8021ddad cs 0x8 rflags
0x202 cr2 0 ilevel 0x8 rsp 0xffffffff85e16680
[ 1.0000000] curlwp 0xffffffff84c01960 pid 0.1 lowest kstack
0xffffffff85e122c0
Stopped in pid 0.1 (system) at netbsd:breakpoint+0x5: leave
db{0}>


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Kamil Rytarowski]

#syz fix: Use an explicit run-time assertion where compile-time doesn't
work.

[syzbot]

I see the command but can't find the corresponding bug.
Please resend the email to syzbo...@syzkaller.appspotmail.com address
that is the sender of the bug report (also present in the Reported-by tag).

> work.

> --
> You received this message because you are subscribed to the Google
> Groups "syzkaller-netbsd-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-netbsd...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-netbsd-bugs/d3196885-8c0f-0fda-e4a2-b7d906ad34aa%40gmx.com.

[Kamil Rytarowski]

[Maxime Villard]

#syz fix: Use an explicit run-time assertion where compile-time doesn't work.