UBSan: Undefined Behavior in db_nextframe (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f5ffeae836a2 hp300 installcd is now bootable so mention it..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=16152fa2980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=869d83d98ee7b072f5cd
compiler: g++ (Debian 12.2.0-14) 12.2.0

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bc2d8b0f0e1b/disk-f5ffeae8.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/0add0d1ec358/netbsd-f5ffeae8.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+869d83...@syzkaller.appspotmail.com

[ 421.0073062] panic: cpu0: softints stuck for 16 seconds
[ 421.0073062] cpu0: Begin traceback...
[ 421.0073062] vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288
[ 421.0073062] panic() at netbsd:panic+0x49 sys/kern/subr_prf.c:1116
[ 421.0073062] heartbeat() at netbsd:heartbeat+0x7c3 select_patient sys/kern/kern_heartbeat.c:549 [inline]
[ 421.0073062] heartbeat() at netbsd:heartbeat+0x7c3 sys/kern/kern_heartbeat.c:706
[ 421.0073062] hardclock() at netbsd:hardclock+0x1d9 sys/kern/kern_clock.c:348
[ 421.0073062] Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
[ 421.0073062] --- interrupt ---
[ 421.0073062] ipi_wait() at netbsd:ipi_wait+0x10b sys/kern/subr_ipi.c:451
[ 421.0073062] _kernel_lock() at netbsd:_kernel_lock+0x53b sys/kern/kern_lock.c:278
[ 421.0073062] intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x23 x86_curcpu sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:64 [inline]
[ 421.0073062] intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x23 sys/arch/x86/x86/intr.c:676
[ 421.0073062] Xhandle_ioapic_edge19() at netbsd:Xhandle_ioapic_edge19+0x75
[ 421.0073062] --- interrupt ---
[ 421.0073062] __sanitizer_cov_trace_const_cmp1() at netbsd:__sanitizer_cov_trace_const_cmp1+0x9 sys/kern/subr_kcov.c:717
[ 421.0073062] _kernel_lock() at netbsd:_kernel_lock+0x482 sys/kern/kern_lock.c:268
[ 421.0073062] mld_timeo() at netbsd:mld_timeo+0x56 sys/netinet6/mld6.c:241
[ 421.0073062] callout_softclock() at netbsd:callout_softclock+0x2ab sys/kern/kern_timeout.c:873
[ 421.0073062] softint_dispatch() at netbsd:softint_dispatch+0x40a softint_execute sys/kern/kern_softint.c:605 [inline]
[ 421.0073062] softint_dispatch() at netbsd:softint_dispatch+0x40a sys/kern/kern_softint.c:848
[ 421.0073062] Skipping crash dump on recursive panic
[ 421.0073062] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/arch/amd64/amd64/db_machdep.c:125:24, member access within misaligned address 0x1 for type 'struct x86_64_frame' which requires 8 byte alignment

[ 421.0073062] Faulted in mid-traceback; aborting...
[ 421.0073062] fatal breakpoint trap in supervisor mode
[ 421.0073062] trap type 1 code 0 rip 0xffffffff80235475 cs 0x8 rflags 0x202 cr2 0x20002600 ilevel 0x7 rsp 0xffffac022fa30bb0
[ 421.0073062] curlwp 0xfffff3b597fc2080 pid 0.5 lowest kstack 0xffffac022fa2d2c0
Stopped in pid 0.5 (system) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:71
vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0xfc sys/../common/lib/libc/misc/ubsan.c:432
db_nextframe() at netbsd:db_nextframe+0x790 sys/arch/amd64/amd64/db_machdep.c:125
db_stack_trace_print() at netbsd:db_stack_trace_print+0x281 sys/arch/x86/x86/db_trace.c:278
db_panic() at netbsd:db_panic+0x9d x86_curcpu sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:64 [inline]
db_panic() at netbsd:db_panic+0x9d sys/ddb/db_panic.c:61
vpanic() at netbsd:vpanic+0x2f0 sys/kern/subr_prf.c:288
panic() at netbsd:panic+0x49 sys/kern/subr_prf.c:1116
heartbeat() at netbsd:heartbeat+0x7c3 select_patient sys/kern/kern_heartbeat.c:549 [inline]
heartbeat() at netbsd:heartbeat+0x7c3 sys/kern/kern_heartbeat.c:706
hardclock() at netbsd:hardclock+0x1d9 sys/kern/kern_clock.c:348
Xresume_lapic_ltimer() at netbsd:Xresume_lapic_ltimer+0x1e
--- interrupt ---
ipi_wait() at netbsd:ipi_wait+0x10b sys/kern/subr_ipi.c:451
_kernel_lock() at netbsd:_kernel_lock+0x53b sys/kern/kern_lock.c:278
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x23 x86_curcpu sys/arch/amd64/compile/obj/GENERIC_SYZKALLER/./machine/cpu.h:64 [inline]
intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x23 sys/arch/x86/x86/intr.c:676
Xhandle_ioapic_edge19() at netbsd:Xhandle_ioapic_edge19+0x75
--- interrupt ---
__sanitizer_cov_trace_const_cmp1() at netbsd:__sanitizer_cov_trace_const_cmp1+0x9 sys/kern/subr_kcov.c:717
_kernel_lock() at netbsd:_kernel_lock+0x482 sys/kern/kern_lock.c:268
mld_timeo() at netbsd:mld_timeo+0x56 sys/netinet6/mld6.c:241
callout_softclock() at netbsd:callout_softclock+0x2ab sys/kern/kern_timeout.c:873
softint_dispatch() at netbsd:softint_dispatch+0x40a softint_execute sys/kern/kern_softint.c:605 [inline]
softint_dispatch() at netbsd:softint_dispatch+0x40a sys/kern/kern_softint.c:848
[ 421.0073062] Skipping crash dump on recursive panic
[ 421.0073062] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/arch/amd64/amd64/db_machdep.c:126:14, member access within misaligned address 0x1 for type 'struct x86_64_frame' which requires 8 byte alignment

[ 421.0073062] Faulted in mid-traceback; aborting...
[ 421.0073062] fatal breakpoint trap in supervisor mode
[ 421.0073062] trap type 1 code 0 rip 0xffffffff80235475 cs 0x8 rflags 0x202 cr2 0x20002600 ilevel 0x8 rsp 0xffffac022fa2f8b0
[ 421.0073062] curlwp 0xfffff3b597fc2080 pid 0.5 lowest kstack 0xffffac022fa2d2c0
Stopped in pid 0.5 (system) at netbsd:breakpoint+0x5: leave


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup