kern/38535: locking bug in ifmedia_ioctl

[martin%duskware.de@localhost]

>Number:         38535
>Category:       kern
>Synopsis:       locking bug in ifmedia_ioctl
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr 28 18:50:00 +0000 2008
>Originator:     Martin Husemann
>Release:        NetBSD 4.99.61
>Organization:
The NetBSD Foundation
>Environment:
System: NetBSD nelly2.aprisoft.de 4.99.61 NetBSD 4.99.61 (NELLY2) #42: Mon Apr 
28 16:03:30 CEST 2008 
martin%emmas.aprisoft.de@localhost:/nelly/usr/src/sys/arch/sparc64/compile/NELLY2
 sparc64
Architecture: sparc64
Machine: sparc64
>Description:

When I boot a LOCKDEBUG/DEBUG/DIAGNOSTIC kernel to single user (root on NFS)
and then run "ifconfig -a" I get this panic:

# ifconfig -a
hme0: flags=88Mutex error: lockdebug_barrier: spin lock held
                                                            
lock address : 0x0000000002755d10 type     :               spin
shared holds :                  0 exclusive:                  1
shares wanted:                  0 exclusive:                  0
current cpu  :                  0 last held:                  0
current lwp  : 0x000000000b95f8c0 last held: 0x000000000b95f8c0
last locked  : 0x0000000001073ab4 unlocked : 0x0000000001073afc
initialized  : 0x0000000001073dd4                              
owner field  : 0x00ff070000000000 wait/spin:                0/1
                                                               
panic: LOCKDEBUG
Stopped in pid 3.1 (ifconfig) at        netbsd:cpu_Debugger+0x4:        nop
db> bt                                                                     
lockdebug_abort1(1476780, 1476780, 120cbf0, 1241308, 1, 800) at netbsd:lockdebug
_abort1+0x7c                                                                   
lockdebug_barrier(145ea00, 1, 3, 1, 0, 0) at netbsd:lockdebug_barrier+0x118
assert_sleepable(2755c50, 122aac0, 24, 122aae8, ffffffffffffba78, 40a0a800) at n
etbsd:assert_sleepable+0x20                                                    
malloc(0, 140d620, 0, b95f8c0, 2755d10, badcafe) at netbsd:malloc+0x230
ifmedia_ioctl(18, c8fdc80, 2755c50, 6, 2755d10, 1) at netbsd:ifmedia_ioctl+0x150
                                                                               
hme_ioctl(27558f0, c0306936, c8fdc80, 0, 1, badcafe) at netbsd:hme_ioctl+0x3c
ifioctl(2d, c0306936, c8fdc80, b95f8c0, 100a740, 40a0003c) at netbsd:ifioctl+0x4
08                                                                             
sys_ioctl(0, c8fddc0, c8fde00, 407472e0, 4091f8e0, 80000000) at netbsd:sys_ioctl
+0xdc                                                                          
syscall_plain(c8fded0, 3, 4073e6e4, 2, 4073e6e4, 800) at netbsd:syscall_plain+0x
120                                                                            
?(3, c0306936, ffffffffffffb978, 401, 0, 0) at 0x10092fc

>How-To-Repeat:
With a lockdebug kernel, boot -s, the run ifconfig -a
(may be hardware driver dependend)
>Fix:
n/a