NetBSD Problem Report #60444

From www@netbsd.org  Mon Jul 13 01:01:50 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 710631A923E
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 13 Jul 2026 01:01:50 +0000 (UTC)
Message-Id: <20260713010149.792601A923F@mollari.NetBSD.org>
Date: Mon, 13 Jul 2026 01:01:49 +0000 (UTC)
From: riz@tastylime.net
Reply-To: riz@tastylime.net
To: gnats-bugs@NetBSD.org
Subject: repeatable mutex "locking against myself" panic
X-Send-Pr-Version: www-1.0
X-From4GNATS: "riz@tastylime.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60444
>Category:       kern
>Synopsis:       repeatable mutex "locking against myself" panic
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 13 01:05:00 +0000 2026
>Last-Modified:  Mon Jul 13 19:30:01 +0000 2026
>Originator:     Jeff Rizzo
>Release:        11.0_RC5
>Organization:
>Environment:
NetBSD cherimoya.tastylime.net 11.0_RC5 NetBSD 11.0_RC5 (GENERIC) #0: Tue Jun 16 15:48:07 UTC 2026  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
Configuring a second bridge(4) interface with brconfig yielded this panic twice in a row:

[ 456.7721093] Mutex error: mutex_vector_enter,551: locking against myself

[ 456.7821085] lock address : ffff824d6f282500
[ 456.7821085] current cpu  :                  1
[ 456.7921086] current lwp  : 0xffff824bc516e000
[ 456.7921086] owner field  : 0xffff824bc516e000 wait/spin:                0/0

[ 456.8021086] panic: lock error: Mutex: mutex_vector_enter,551: locking against myself: lock 0xffff824d6f282500 cpu 1 lwp 0xffff824bc516e000
[ 456.8121087] cpu1: Begin traceback...
[ 456.8221084] vpanic() at netbsd:vpanic+0x171
[ 456.8221084] panic() at netbsd:panic+0x3c
[ 456.8321084] lockdebug_abort() at netbsd:lockdebug_abort+0x114
[ 456.8421084] mutex_vector_enter() at netbsd:mutex_vector_enter+0x397
[ 456.8521084] bridge_input() at netbsd:bridge_input+0xaaf
[ 456.8521084] vlan_input() at netbsd:vlan_input+0x165
[ 456.8621084] ether_input() at netbsd:ether_input+0x2d2
[ 456.8721087] bridge_input() at netbsd:bridge_input+0xace
[ 456.8721087] lagg_input_ethernet() at netbsd:lagg_input_ethernet+0x20c
[ 456.8821084] if_percpuq_softint() at netbsd:if_percpuq_softint+0x9e
[ 456.8921085] softint_dispatch() at netbsd:softint_dispatch+0x95
[ 456.9021084] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffd214ab5640f0
[ 456.9021084] Xsoftintr() at netbsd:Xsoftintr+0x4c
[ 456.9121086] --- interrupt ---
[ 456.9121086] 0:
[ 456.9121086] cpu1: End traceback...

[ 456.9221086] dumping to dev 168,8 (offset=8, size=18872056):
[ 456.9221086] dump failed: insufficient space (4194304 < 10795333)
>How-To-Repeat:
The current network configuration of this host, from rc.conf:

auto_ifconfig=NO
net_interfaces="lagg0 wm0 wm1 vlan600 bridge0"
ifconfig_bridge0="create ; up ; !brconfig bridge0 add lagg0"
ifconfig_wm0="up"
ifconfig_wm1="up"
ifconfig_lagg0="create ; laggproto lacp ; laggport wm0 ; laggport wm1 ; inet XXX.XXX.XXX.43/26 ; inet6 2001:xxxx:xxxx:2::43 prefixlen 64 ; up"
ifconfig_vlan600="create ; vlan 600 vlanif lagg0 ; up"

This runs fine; however, I wanted to add a second bridge(4) bridging the "vlan600" interface, for access by some virtual machines. Doing the following:

# ifconfig bridge600 create
# ifconfig bridge600 up
# brconfig bridge600 add vlan600

...repeatably causes the panic.  Yes, vlan600 is tagged on lagg0.  Yes, bridge0 bridges untagged frames from lagg0 .  I can't easily try changing the "untagged" frames to another vlan right now (they'd be on vlan2) to see if that gets rid of the panic.  This may well be a "don't do that" situation, but I figured I should let folks know, at least.
>Fix:
None given.  Maybe just "don't do that".

>Audit-Trail:
From: Jeff Rizzo <riz@tastylime.net>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/60444: repeatable mutex "locking against myself" panic
Date: Sun, 12 Jul 2026 20:36:00 -0700

 I verified that creating the bridges in the other order (vlan600 before 
 lagg0) yields a very similar crash:

 [ 9917.1289071] Mutex error: mutex_vector_enter,551: locking against myself

 [ 9917.1389070] lock address : ffff81232f282500
 [ 9917.1489066] current cpu  :                  1
 [ 9917.1489066] current lwp  : 0xffff81218516e000
 [ 9917.1589066] owner field  : 0xffff81218516e000 wait/spin:         0/0

 [ 9917.1589066] panic: lock error: Mutex: mutex_vector_enter,551: 
 locking against myself: lock 0xffff81232f282500 cpu 1 lwp 0xffff81218516e000
 [ 9917.1789065] cpu1: Begin traceback...
 [ 9917.1789065] vpanic() at netbsd:vpanic+0x171
 [ 9917.1889067] panic() at netbsd:panic+0x3c
 [ 9917.1989064] lockdebug_abort() at netbsd:lockdebug_abort+0x114
 [ 9917.1989064] mutex_vector_enter() at netbsd:mutex_vector_enter+0x397
 [ 9917.2089065] bridge_input() at netbsd:bridge_input+0xaaf
 [ 9917.2189064] vlan_input() at netbsd:vlan_input+0x165
 [ 9917.2189064] ether_input() at netbsd:ether_input+0x2d2
 [ 9917.2289067] bridge_input() at netbsd:bridge_input+0xace
 [ 9917.2389066] lagg_input_ethernet() at netbsd:lagg_input_ethernet+0x20c
 [ 9917.2489066] if_percpuq_softint() at netbsd:if_percpuq_softint+0x9e
 [ 9917.2489066] softint_dispatch() at netbsd:softint_dispatch+0x95
 [ 9917.2589066] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 
 0xffff8914ab5640f0
 [ 9917.2689066] Xsoftintr() at netbsd:Xsoftintr+0x4c
 [ 9917.2789064] --- interrupt ---
 [ 9917.2789064] 0:
 [ 9917.2789064] cpu1: End traceback...

 [ 9917.2789064] dumping to dev 168,8 (offset=8, size=18872056):
 [ 9917.2889068] dump failed: insufficient space (4194304 < 10579091)


 [ 9922.8788941] rebooting...

From: Jeff Rizzo <riz@tastylime.net>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/60444: repeatable mutex "locking against myself" panic
Date: Mon, 13 Jul 2026 12:26:26 -0700

 I just did a test with a -current (11.99.6) kernel; the issue persists 
 and looks similar crashwise:

 [ 166.4109013] Mutex error: mutex_vector_enter,551: locking against myself

 [ 166.4109013] lock address : ffff92de2ef0e940
 [ 166.4209012] current cpu  :                  1
 [ 166.4209012] current lwp  : 0xffff92de0cdef800
 [ 166.4309006] owner field  : 0xffff92de0cdef800 wait/spin:         0/0

 [ 166.4409006] panic: lock error: Mutex: mutex_vector_enter,551: locking 
 against myself: lock 0xffff92de2ef0e940 cpu 1 lwp 0xffff92de0cdef800
 [ 166.4509004] cpu1: Begin traceback...
 [ 166.4509004] vpanic() at netbsd:vpanic+0x189
 [ 166.4609004] panic() at netbsd:panic+0x3c
 [ 166.4709007] lockdebug_abort() at netbsd:lockdebug_abort+0x115
 [ 166.4709007] mutex_vector_enter() at netbsd:mutex_vector_enter+0x392
 [ 166.4809004] bridge_input() at netbsd:bridge_input+0xcf5
 [ 166.4909003] vlan_input() at netbsd:vlan_input+0xd8
 [ 166.4909003] ether_input() at netbsd:ether_input+0x70f
 [ 166.5009003] bridge_input() at netbsd:bridge_input+0xd14
 [ 166.5109003] lagg_input_ethernet() at netbsd:lagg_input_ethernet+0x1f6
 [ 166.5209002] if_percpuq_softint() at netbsd:if_percpuq_softint+0x9e
 [ 166.5309003] softint_dispatch() at netbsd:softint_dispatch+0x112
 [ 166.5309003] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 
 0xffff9894ab55c0f0
 [ 166.5409002] Xsoftintr() at netbsd:Xsoftintr+0x4c
 [ 166.5509001] --- interrupt ---
 [ 166.5509001] 0:
 [ 166.5509001] cpu1: End traceback...

 [ 166.5509001] dumping to dev 168,8 (offset=8, size=18872056):
 [ 166.5609002] dump failed: insufficient space (4194304 < 9454053)


 [ 172.1808839] rebooting...

Home	PR Database Search