NetBSD Problem Report #54783

From martin@duskware.de  Wed Dec 18 14:40:59 2019
Return-Path: <martin@duskware.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 1376D7A1D7
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 18 Dec 2019 14:40:58 +0000 (UTC)
From: martin@NetBSD.org
Reply-To: martin@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: t_mmap crahes the kernel
X-Send-Pr-Version: 3.95

>Number:         54783
>Category:       kern
>Synopsis:       t_mmap crahes the kernel
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    ad
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Dec 18 14:45:00 +0000 2019
>Closed-Date:    Wed Dec 18 20:58:09 +0000 2019
>Last-Modified:  Wed Dec 18 20:58:09 +0000 2019
>Originator:     Martin Husemann
>Release:        NetBSD 9.99.26
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD unpluged.duskware.de 9.99.26 NetBSD 9.99.26 (UNPLUGED) #280: Wed Dec 18 13:01:47 CET 2019 martin@seven-days-to-the-wolves.aprisoft.de:/work/src/sys/arch/evbarm/compile/UNPLUGED evbarm
Architecture: earm
Machine: evbarm
>Description:

I can reproducably (as non-root user) crash the kernel on this machine.

tp-start: 1576679784.224805, t_mmap, 9
tc-start: 1576679784.225301, mmap_block
tc-end: 1576679784.227739, mmap_block, skipped, Requires root privileges
tc-start: 1576679784.228226, mmap_err
tc-end: 1576679784.281310, mmap_err, passed
tc-start: 1576679784.283658, mmap_loan
[ 293.9037747] Mutex error: mutex_vector_exit,737: assertion failed: MUTEX_OWNER(mtx->mtx_owner) == curthread

[ 293.9037747] lock address : 0x00000000c2877294
[ 293.9037747] current cpu  :                  0
[ 293.9037747] current lwp  : 0x00000000c33989e0
[ 293.9037747] owner field  : 000000000000000000 wait/spin:                0/0

[ 293.9037747] panic: lock error: Mutex: mutex_vector_exit,737: assertion failed: MUTEX_OWNER(mtx->mtx_owner) == curthread: lock 0xc2877294 cpu 0 lwp 0xc33989e0
[ 293.9037747] cpu0: Begin traceback...
[ 293.9037747] 0xccdabd2c: netbsd:vpanic+0x114
[ 293.9037747] Bad frame pointer: 0xc0570760
[ 293.9037747] cpu0: End traceback...
[ 293.9037747] rebooting...


>How-To-Repeat:

cd /usr/tests/lib/libc/sys && atf-run t_mmap

>Fix:
n/a

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->ad
Responsible-Changed-By: ad@NetBSD.org
Responsible-Changed-When: Wed, 18 Dec 2019 14:47:27 +0000
Responsible-Changed-Why:
yeet


From: "Andrew Doran" <ad@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/54783 CVS commit: src/sys/uvm
Date: Wed, 18 Dec 2019 20:38:14 +0000

 Module Name:	src
 Committed By:	ad
 Date:		Wed Dec 18 20:38:14 UTC 2019

 Modified Files:
 	src/sys/uvm: uvm_loan.c uvm_page.c

 Log Message:
 PR kern/54783: t_mmap crahes the kernel

 - Fix various locking & sequencing errors with breaking loans.

 - Don't call uvm_pageremove_tree() while holding pg->interlock as radixtree
   can take further locks when freeing nodes.


 To generate a diff of this commit:
 cvs rdiff -u -r1.91 -r1.92 src/sys/uvm/uvm_loan.c
 cvs rdiff -u -r1.205 -r1.206 src/sys/uvm/uvm_page.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: ad@NetBSD.org
State-Changed-When: Wed, 18 Dec 2019 20:50:42 +0000
State-Changed-Why:
believe fixed


State-Changed-From-To: feedback->closed
State-Changed-By: martin@NetBSD.org
State-Changed-When: Wed, 18 Dec 2019 20:58:09 +0000
State-Changed-Why:
Works for me, thanks for quick fix!


>Unformatted:

Home	PR Database Search