NetBSD Problem Report #48386

From www@NetBSD.org  Sun Nov 17 19:31:09 2013
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id E345FA5676
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 17 Nov 2013 19:31:08 +0000 (UTC)
Message-Id: <20131117193107.64484A61B3@mollari.NetBSD.org>
Date: Sun, 17 Nov 2013 19:31:07 +0000 (UTC)
From: aran@100acres.us
Reply-To: aran@100acres.us
To: gnats-bugs@NetBSD.org
Subject: Kernel panic on shutdown 
X-Send-Pr-Version: www-1.0

>Number:         48386
>Category:       kern
>Synopsis:       Kernel panic on shutdown
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 17 19:35:00 +0000 2013
>Originator:     Aran Clauson
>Release:        6.99.27
>Organization:
>Environment:
NetBSD sanders 6.99.27 NetBSD 6.99.27 (GENERIC) #0: Sun Nov 17 00:08:39 PST 2013  aran@sanders:/home/NetBSD/obj/sys/arch/amd64/compile/GENERIC amd64
>Description:
When shutting down I sometimes get a kernel panic.  Now that I have a kernel with debugging turned on, I've been able to case down the error.  The panic is at src/sys/kern/kern_uidinfo.c:217:

209     int
210     chglwpcnt(uid_t uid, int diff)
211     {
212             struct uidinfo *uip;
213             long lwpcnt;
214
215             uip = uid_find(uid);
216             lwpcnt = atomic_add_long_nv(&uip->ui_lwpcnt, diff);
217             KASSERT(lwpcnt >= 0);
218             return lwpcnt;
219     }

This is called from lwp_free when shutting down dhclient.  It appears that dhclient has two remaining threads, but the user info structure says that ui_lwpcnt==0 for UDI=0.  The atomic_add_long_nv decrements the count to -1 and the assert fails.


>How-To-Repeat:

>Fix:

Home	PR Database Search