Re: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed

[Andrew Doran <ad%netbsd.org@localhost>]

Hi,

On Fri, Jun 12, 2020 at 11:17:30PM +0200, Thomas Klausner wrote:

> With a 9.99.63/amd64 kernel from May 19 I saw a panic:
> 
> Jun  7 01:01:01 yt savecore: reboot after panic: [ 396809.5836453] panic: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed: file "/usr/src/sys/kern/kern_timeout.c", line 322 running callout 0xffff835adaa87658: c_func (0xffffffff809f459f) c_flags (0x100) destroyed from 0xffffffff809f264b
> Jun  7 01:01:01 yt savecore: writing compressed core to /var/crash/netbsd.12.core.gz
> 
> (gdb) bt
> #0  0xffffffff80226865 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:713
> #1  0xffffffff80cd387f in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:73
> #2  0xffffffff80d1285e in vpanic (
>     fmt=0xffffffff8143e908 "kernel %sassertion \"%s\" failed: file \"%s\", line %d running callout %p: c_func (%p) c_flags (%#x) destroyed from %p", 
>     ap=ap@entry=0xffff850916323c88) at /usr/src/sys/kern/subr_prf.c:290
> #3  0xffffffff80e834b6 in kern_assert (
>     fmt=fmt@entry=0xffffffff8143e908 "kernel %sassertion \"%s\" failed: file \"%s\", line %d running callout %p: c_func (%p) c_flags (%#x) destroyed from %p")
>     at /usr/src/sys/lib/libkern/kern_assert.c:51
> #4  0xffffffff80cf1708 in callout_destroy (cs=cs@entry=0xffff835adaa87658) at /usr/src/sys/kern/kern_timeout.c:323
> #5  0xffffffff809f264b in tcp_close (tp=tp@entry=0xffff835adaa874c8) at /usr/src/sys/netinet/tcp_subr.c:1227
> #6  0xffffffff809ecb83 in tcp_input (m=0xffff83415e784b00, off=20, proto=<optimized out>) at /usr/src/sys/netinet/tcp_input.c:2396
> #7  0xffffffff809dde5f in ip_input (m=<optimized out>) at /usr/src/sys/netinet/ip_input.c:816
> #8  ipintr (arg=<optimized out>) at /usr/src/sys/netinet/ip_input.c:402
> #9  0xffffffff80ce18ae in softint_execute (s=4, l=0xffff835d46efb480) at /usr/src/sys/kern/kern_softint.c:565
> #10 softint_dispatch (pinned=<optimized out>, s=4) at /usr/src/sys/kern/kern_softint.c:814
> #11 0xffffffff80220eef in Xsoftintr ()
> (gdb)
> 
> Is this probably already fixed or should I file a PR?
>  Thomas

I had a brief look at this before but I don't know the networking code too
well.  Basically something is starting a TCP timer after/during its
destruction.  It seems to be a old bug but whatever you're doing is managing
to trigger it.  It's definitely worth a PR.

Cheers,
Andrew