kern/39384: tcpdrop(8) causes panic

[Taylor R Campbell <campbell%mumble.net@localhost>]

>Number:         39384
>Category:       kern
>Synopsis:       tcpdrop(8) causes panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 19 23:05:00 +0000 2008
>Originator:     Taylor R Campbell <campbell%mumble.net@localhost>
>Release:        NetBSD 4.99.72
>Organization:
>Environment:
System: NetBSD icon.localdomain 4.99.72 NetBSD 4.99.72 (RIAXEN3_DOMU) #6: Sat 
Aug  9 03:34:22 UTC 2008  
riastradh%smalltalk.localdomain@localhost:/home/riastradh/netbsd/current/obj/sys/arch/i386/compile/RIAXEN3_DOMU
 i386
Architecture: i386
Machine: i386
>Description:

        tcpdrop(8) causes a kernel panic and drops me into ddb:

panic: kernel diagnostic assertion "solocked(sb->sb_so)" failed: file 
"/home/riastradh/netbsd/current/src/sys/sys/socketvar.h", line 375
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c039a78c cs 9 eflags 246 cr2 bbbad222 ilevel 4
Stopped in pid 605.1 (tcpdrop) at       netbsd:breakpoint+0x4:  popl    %ebp
db> bt
breakpoint(c0447b1b,cadae988,c045d140,c08e19c4,c0856dec,0,cadae99c,c01176a7,c0856e1c,cadae988)
 at netbsd:breakpoint+0x4
panic(c0451a78,c04166d8,c0417025,c041703c,177,0,cadaea8c,c01281ec,c04166d8,c041703c)
 at netbsd:panic+0x1b2
__kernassert(c04166d8,c041703c,177,c0417025,0,0,0,c9b1ca40,cac35900,0) at 
netbsd:__kernassert+0x39
tcp_output(c08e19c4,0,0,cac35900,3e8,c08e19c4,cadaec0c,c012fd11,c08e19c4,35) at 
netbsd:tcp_output+0x1edc
tcp_drop(c08e19c4,35,0,302a8c0,fcff,ffffffff,0,c03ae5b7,0,0) at 
netbsd:tcp_drop+0x57
sysctl_net_inet_tcp_ident(cadaecac,0,0,cadaeccc,bfbfeba8,100,cadaec9c,cacaa0a0,c08379c0,ffffffff)
 at netbsd:sysctl_net_inet_tcp_ident+0x541
sysctl_dispatch(cadaec9c,4,0,cadaeccc,bfbfeba8,100,cadaec9c,cacaa0a0,c08379c0,1000)
 at netbsd:sysctl_dispatch+0xcf
sys___sysctl(cacaa0a0,cadaed00,cadaed28,bbbad222,bbbad000,c9b18000,1,bfbfeca8,4,0)
 at netbsd:sys___sysctl+0xd6
syscall(cadaed48,1f,1f,1f,1f,0,bbbe7e80,bfbfe318,bbbd4ef8,4) at 
netbsd:syscall+0xaa
db> dmesg
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 4.99.72 (RIAXEN3_DOMU) #6: Sat Aug  9 03:34:22 UTC 2008
        
riastradh%smalltalk.localdomain@localhost:/home/riastradh/netbsd/current/obj/sys/arch/i386/compile/RIAXEN3_DOMU
total memory = 128 MB
avail memory = 121 MB
timecounter: Timecounters tick every 10.000 msec
mainbus0 (root)
hypervisor0 at mainbus0: Xen version 3.1
vcpu0 at hypervisor0: Intel 686-class, 1495MHz, id 0x695
vcpu0: 32 page colors
debug virtual interrupt using event channel 3
xenbus0 at hypervisor0: Xen Virtual Bus Interface
xencons0 at hypervisor0: Xen Virtual Console Driver
xencons0: console major 143, unit 0
xencons0: using event channel 2
npx0 at hypervisor0: using exception 16
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
Xen clock: using event channel 4
timecounter: Timecounter "xen_system_time" frequency 1000000000 Hz quality 10000
xenbus0: using event channel 1
unknown type console at xenbus0 id 0 not configured
xbd0 at xenbus0 id 1: Xen Virtual Block Device Interface
xbd0: using event channel 5
xennet0 at xenbus0 id 0: Xen Virtual Network Interface
xennet0: MAC address 00:16:3e:00:00:11
xennet0: using event channel 6
xbd0: 25229 MB, 512 bytes/sect x 51670017 sectors
raidattach: Asked for 8 units
Kernelized RAIDframe activated
Searching for RAID components...
unknown type console at xenbus0 id 0 not configured
boot device: xbd0
root on xbd0a dumps on xbd0b
dump_misc_init: max_paddr = 0x8100000
mountroot: trying lfs...
unknown type console at xenbus0 id 0 not configured
mountroot: trying ffs...
root file system type: ffs
init: copying out path `/sbin/init' 11
panic: kernel diagnostic assertion "solocked(sb->sb_so)" failed: file 
"/home/riastradh/netbsd/current/src/sys/sys/socketvar.h", line 375
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c039a78c cs 9 eflags 246 cr2 bb930000 ilevel 4
db> 

        Kernel configuration:

include "arch/i386/conf/XEN3_DOMU"

options         VND_COMPRESSION

pseudo-device   cgd     4

options         FFS_EI          # FFS Endian Independent support
options         APPLE_UFS       # Apple UFS support in FFS

pseudo-device   putter
file-system     PUFFS           # experimental - Userspace file system support
makeoptions     MKPUFFS=yes

        I first observed this while testing puffs and dropping ssh
        connections for sshfs mounts, but the problem occurs in more
        mundane situations.

>How-To-Repeat:

        Open a TCP connection.  Try to drop it with tcpdrop(8).

>Fix:

        Diagnosing this to the point of a fix is, alas, beyond my
        capacity at the moment.