kern/40458: KASSERT in uvm_rb_fixup

[spz%NetBSD.org@localhost]

>Number:         40458
>Category:       kern
>Synopsis:       KASSERT in uvm_rb_fixup
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 23 07:25:00 +0000 2009
>Originator:     S.P.Zeidler
>Release:        NetBSD 5.0_BETA 20090107
>Organization:
        TNF
>Environment:
System: NetBSD pkgbuild.netbsd.org 5.0_BETA NetBSD 5.0_BETA (PKGBUILD.SCHED_M2) 
#4: Wed Jan 7 22:24:22 UTC 2009 
spz@ADMIN:/chroots/netbsd-5/src/sys/arch/amd64/compile/obj/PKGBUILD.SCHED_M2 
amd64
Architecture: x86_64
Machine: amd64
>Description:
panic: kernel debugging assertion "parent->gap == uvm_rb_gap(parent)" failed: 
file "/chroots/netbsd-5/src/sys/uvm/uvm_map.c", line 389
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80501105 cs 8 rflags 246 cr2  7f7ffda46020 cpl 0 
rsp ffff80007c9a2520
Stopped in pid 22588.1 (rm) at  netbsd:breakpoint+0x5:  leave
db{1}> bt
breakpoint() at netbsd:breakpoint+0x5
cpu_Debugger() at netbsd:cpu_Debugger+0x9
panic() at netbsd:panic+0x260
__kernassert() at netbsd:__kernassert+0x2d
uvm_rb_fixup() at netbsd:uvm_rb_fixup+0x161
uvm_rb_remove() at netbsd:uvm_rb_remove+0xa5
uvm_unmap_remove() at netbsd:uvm_unmap_remove+0x169
uvm_kmapent_free() at netbsd:uvm_kmapent_free+0x186
uvm_mapent_free() at netbsd:uvm_mapent_free+0x12
uvm_unmap_detach() at netbsd:uvm_unmap_detach+0x7d
uvm_unmap1() at netbsd:uvm_unmap1+0x8b
uvm_km_free() at netbsd:uvm_km_free+0x91
kmem_backend_free() at netbsd:kmem_backend_free+0x54
vmem_xfree() at netbsd:vmem_xfree+0x1c9
vmem_free() at netbsd:vmem_free+0x7e
kmem_free() at netbsd:kmem_free+0x73
hashdone() at netbsd:hashdone+0x33
uao_detach_locked() at netbsd:uao_detach_locked+0x10d
uao_detach() at netbsd:uao_detach+0x1f
tmpfs_free_node() at netbsd:tmpfs_free_node+0xa1
tmpfs_reclaim() at netbsd:tmpfs_reclaim+0x9b
VOP_RECLAIM() at netbsd:VOP_RECLAIM+0x61
vclean() at netbsd:vclean+0x182
vrelel() at netbsd:vrelel+0x4f0
vrele() at netbsd:vrele+0x66
vput() at netbsd:vput+0x25
tmpfs_remove() at netbsd:tmpfs_remove+0x1b7
VOP_REMOVE() at netbsd:VOP_REMOVE+0x69
do_sys_unlink() at netbsd:do_sys_unlink+0x171
sys_unlink() at netbsd:sys_unlink+0x11
syscall() at netbsd:syscall+0xb6
db{1}> sh reg
ds          0x24f0
es          0x7
fs          0x8
gs          0x58ae
rdi         0
rsi         0x3f8
rbp         0xffff80007c9a2520
rbx         0xffff80007c9a2540
rdx         0x8
rcx         0
rax         0x1
r8          0xffffffff809d2eea  copyright+0x887aa
r9          0x1
r10         0xffff80007c9a2430
r11         0x8
r12         0x100
r13         0xffffffff809e0ca8  copyright+0x96568
r14         0xffff80009046b9b8
r15         0xffffffff80c5bd40  kernel_map_store
rip         0xffffffff80501105  breakpoint+0x5
cs          0x8
rflags      0x246
rsp         0xffff80007c9a2520
ss          0x10
netbsd:breakpoint+0x5:  leave
db{1}> mach cpu 0
using CPU 0
db{1}> bt
x86_stihlt() at netbsd:x86_stihlt+0x6
x86_cpu_idle_halt() at netbsd:x86_cpu_idle_halt+0x34
idle_loop() at netbsd:idle_loop+0x198
db{1}> mach cpu 2
using CPU 2
db{1}> bt
uvm_fault(0xffff80008e525760, 0x695000, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff805029ec cs 8 rflags 10246 cr2  695002 cpl 8 rsp 
ffff80007c9a1f20
kernel: page fault trap, code=0
Faulted in DDB; continuing...
db{1}> mach cpu 3
using CPU 3
db{1}> bt
x86_stihlt() at netbsd:x86_stihlt+0x6
x86_cpu_idle_halt() at netbsd:x86_cpu_idle_halt+0x34
idle_loop() at netbsd:idle_loop+0x198
Bad frame pointer: 0xffff80006c35b420

>How-To-Repeat:
>Fix: