>Number:         36659
>Category:       kern
>Synopsis:       Occasionally envstat hangs or causes a reboot with aiboost
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 17 02:30:00 +0000 2007
>Originator:     Geoff C. Wing
>Release:        NetBSD 4.99.23 (2007-07-17)
>Organization:
>Environment:
System: NetBSD g.primenet.com.au 4.99.23 NetBSD 4.99.23 (G) #0: Tue Jul 17 11:36:55 EST 2007 gcw@g.primenet.com.au:/usr/netbsd/src/sys/arch/i386/compile/G i386
Architecture: i386
Machine: i386
>Description:
	Occasionally envstat has problems reading sensors on my system,
	either hanging or causing a dump.

	Something's funny with the dump trace.
	#10 ../../../../kern/subr_workqueue.c:209 is workqueue_finiqueue()
	so it's been inlined or stomped on or something.

	Anyway, the wq list looks damaged?

	Maybe this is a workqueue problem?

(gdb) bt
#0  0xc0348f3d in cpu_reboot (howto=0, bootstr=0x0) at ../../../../arch/i386/i386/machdep.c:853
#1  0xc02ced64 in panic (fmt=0xc04bceec "trap") at ../../../../kern/subr_prf.c:246
#2  0xc0353353 in trap (frame=0xce39f6c0) at ../../../../arch/i386/i386/trap.c:342
#3  0xc010c3da in calltrap ()
#4  0xc0345506 in db_read_bytes (addr=6, size=4, data=0xce39f72c "") at ../../../../arch/i386/i386/db_memrw.c:98
#5  0xc01671ed in db_get_value (addr=6, size=4, is_signed=false) at ../../../../ddb/db_access.c:62
#6  0xc0345e35 in db_stack_trace_print (addr=-835061728, have_addr=true, count=65535, modif=0xc04d5450 "", pr=0xc02ceba7 <printf>)
    at ../../../../arch/i386/i386/db_trace.c:147
#7  0xc02ced35 in panic (fmt=0xc04bceec "trap") at ../../../../kern/subr_prf.c:235
#8  0xc0353353 in trap (frame=0xce39f8c4) at ../../../../arch/i386/i386/trap.c:342
#9  0xc010c3da in calltrap ()
#10 0xc02d1c0b in workqueue_destroy (wq=0xcc73f350) at ../../../../kern/subr_workqueue.c:209
#11 0xc011986a in sme_event_unregister (sensor=0xc28173a0 "CPU FAN Speed", type=160) at ../../../../dev/sysmon/sysmon_envsys_events.c:258
#12 0xc011766d in sme_userset_dictionary (sme=0xc27ac04c, udict=0xcc7ca514, array=0xcc7c4f78) at ../../../../dev/sysmon/sysmon_envsys.c:998
#13 0xc011869f in sysmonioctl_envsys (dev=17152, cmd=3221767425, data=0xce39fb88, flag=1, l=0xce54ea80) at ../../../../dev/sysmon/sysmon_envsys.c:298
#14 0xc02c720e in cdev_ioctl (dev=17152, cmd=3221767425, data=0xce39fb88, flag=1, l=0xce54ea80) at ../../../../kern/subr_devsw.c:770
#15 0xc03109dd in spec_ioctl (v=0xce39fa60) at ../../../../miscfs/specfs/spec_vnops.c:439
#16 0xc0309d9d in VOP_IOCTL (vp=0xcda89210, command=3221767425, data=0xce39fb88, fflag=1, cred=0xce4c6e04, l=0xce54ea80)
    at ../../../../kern/vnode_if.c:504
#17 0xc03071bb in vn_ioctl (fp=0xce3f8e58, com=3221767425, data=0xce39fb88, l=0x6) at ../../../../kern/vfs_vnops.c:602
#18 0xc02d49fc in sys_ioctl (l=0xce54ea80, v=0xce39fc48, retval=0xce39fc68) at ../../../../kern/sys_generic.c:728
#19 0xc0352ea8 in syscall_plain (frame=0xce39fc88) at ../../../../arch/i386/i386/syscall.c:148
#20 0xc01004c8 in syscall1 ()
(gdb)
...
#10 0xc02d1c0b in workqueue_destroy (wq=0xcc73f350) at ../../../../kern/subr_workqueue.c:209
209             wqe.wqe_q = q;
(gdb) p *wq
$1 = {wq_queue = {slh_first = 0x75d6389a}, wq_func = 0xc02d1cf7 <workqueue_exit>, wq_arg = 0x0, wq_name = 0xc04aad87 "envsysev", wq_prio = 0, wq_ipl = {_ipl = 4 '\004'}}


	
>How-To-Repeat:
	?
>Fix:
	?