kern/38278: Crashes in kmem_poison_check (probably caused by puffs)

[jmmv%netbsd.org@localhost]

>Number:         38278
>Category:       kern
>Synopsis:       Crashes in kmem_poison_check (probably caused by puffs)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 22 17:45:00 +0000 2008
>Originator:     Julio M. Merino Vidal
>Release:        NetBSD 4.99.56, sources as of today (20080322)
>Organization:
Julio M. Merino Vidal <jmmv%NetBSD.org@localhost>
>Environment:
        
        
Architecture: i386
Machine: i386
>Description:
        NetBSD-current, with sources as of today, crashes when using
        puffs.  I think there was some PR that mentioned this, but I
        have been unable to find it, so... maybe the original issues
        that one reported (which started happening a couple of months
        ago, IIRC), were resolved and these problems are new ones.

        Given the backtraces I am getting, I don't really know if they
        are caused by puffs or not, but using puffs's test cases trigger
        the problem easily.  With a regular GENERIC kernel I get a hard
        lockup of the machine; with a DIAGNOSTIC kernel I get a panic in
        kmem_poison_check.  The two times I tried, it paniced in
        different ways.

        First attempt:

panic: kmem_poison_check: 0xcc5b9030: 0x2b != 0x2c

Stopped in pid 458.1 (sh) at netbsd:breakpoint+0x4: popl %ebp
dt{1}> bt
breakpoint(c0a837ef,cc5aca78,c1d3b000,c046cb33,274) at netbsd:breakpoint+0x4
panic(c0a25d21,c08128b9,cc5b9030,2b,2c) at netbsd:panic+0x1ba
kmem_poison_check(405,405,1001,bb93733c,0) at netbsd:kmem_poison_check+0x76
kmem_alloc(404,1,400,cc5acc9c,c0b6d400) at netbsd:kmem_alloc+0x5e
execve1(cc55b200,bb93733c,bb9372ec,bb9372fc,c04638f0) at netbsd:execve1+0x129
sys_execve(cc55b200,cc5acd00,cc5acd28,bbb870b0,bbb87000) at 
netbsd:sys_execve+0x31
syscall(cc5acd48,bb9000b3,ab,bfbf001f,bbbb001f) at netbsd:syscall+0xb3
db{1}>

        Second attempt:

panic: kmem_poison_check: 0xc571030: 0x88 != 0x89

Stopped in pid 1187.1 (sh) at netbsd:breakpoint+0x4: popl %ebp
db{0}> bt
breakpoint(c0a837ef,cc51fad8,c0ab0600,0,0) at netbsd:breakpoint+0x4
panic(c0a35d21,c08128b9,cc571030,88,89) at netbsd:panic+0x1ba
kmem_poison_check(3c1,3c1,1002,c0409861,2) at netbsd:kmem_poison_check+0x76
kmem_alloc(3c0,2,0,cc589d18,caf7ac40) at netbsd:kmem_alloc+0x5e
amap_copy(caf7ac40,cc002790,2,bb937000,bb937001) at netbsd:amap_copy+0x144
uvm_fault_internal(caf7ac40,bb937000,2,0,0) at netbsd:uvm_fault_internal+0xe31
trap() at netbsd:trap+0x6de
--- trap (number 6) ---
0x8050030:
db{0}>
>How-To-Repeat:
        With a puffs-enabled kernel:

        # cd /usr/tests/fs/puffs
        # ./t_psshfs

        Watch it panic (with diagnostic) or freeze (without diagnostic).
>Fix:
        Unknown.

>Unformatted: