Re: kern/42656: netbsd-5: panic LOCKDEBUG in opencrypto(9) w/ hifn(4)

[Hubert Feyrer <hubert%feyrer.de@localhost>]

The following reply was made to PR kern/42656; it has been noted by GNATS.

From: Hubert Feyrer <hubert%feyrer.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/42656: netbsd-5: panic LOCKDEBUG in opencrypto(9) w/
 hifn(4)
Date: Fri, 22 Jan 2010 12:28:31 +0100 (CET)

 On Fri, 22 Jan 2010, Hubert Feyrer wrote:
 > Adding DIAGNOSTICS to the kernel, the panics happen, too
 > (with a somewhat funky traceback, though):
 
 Here's an updated panic, which shows the same place, but that it happens 
 in glxsb - so it's not specific to hifn, but a general bug in the 
 opencrypto system.
 
 Full data:
 
 Fr 22 Jan 2010 12:08:01 CET
 NetBSD 5.0/i386 with sources from netbsd-5 branch as of 20090121
 
 sh -c 'while true ; do openssl speed -evp aes-128-cbc -elapsed ; done'
 # Mutex error: lockdebug_barrier: spin lock held
 
 lock address : 0x00000000c0477af4 type     :               spin
 initialized  : 0x00000000c0113304
 shared holds :                  0 exclusive:                  1
 shares wanted:                  0 exclusive:                  0
 current cpu  :                  0 last held:                  0
 current lwp  : 0x00000000cb579860 last held: 0x00000000cb579860
 last locked  : 0x00000000c0117945 unlocked : 0x00000000c0118aa9
 owner field  : 0x0000000000010600 wait/spin:                0/1
 
 panic: LOCKDEBUG
 fatal breakpoint trap in supervisor mode
 trap type 1 code 0 eip c033879c cs 8 eflags 246 cr2 bb9bd600 ilevel 6
 Stopped in pid 875.1 (openssl) at       netbsd:breakpoint+0x4:  popl 
 %ebp
 db{0}>
 db{0}> bt
 breakpoint(c04063c0,cb5b5838,c0426f80,c02a1f4f,6,1,0,0,cb5b5838,c0100e11) 
 at net
 bsd:breakpoint+0x4
 panic(c04063c2,c0403e73,c03daf74,c04063db,4,1000001,6,0,20,cb5b58f0) at 
 netbsd:panic+0x1b0
 
lockdebug_abort1(c04063db,1,0,0,cb5b59c4,cb5b5dc0,cb579860,0,cb5b5cbc,cb5b58f4) 
 at netbsd:lockdebug_abort1+0xbb
 
mutex_vector_enter(c047fb2c,cb5b5d48,80879d8,4,cb56d768,cb579860,cb5b58dc,c03b5b56,cb763240,20)
 
 at netbsd:mutex_vec
 tor_enter+0x3cd
 
rnd_extract_data(cb5b58f0,20,1,c03b5b56,cb763240,cb4f8b00,cb5b590c,c03b5b56,cb763240,cb4f8b00)
 
 at netbsd:rnd_extrac
 t_data+0x13
 
arc4_randrekey(c0e40a10,10,cb5b5a3c,c029bb08,ca016d4c,c0e40a00,0,c0117945,cb579860,6)
 
 at netbsd:arc4_randrekey+0x3d
 
glxsb_crypto_newsession(ca67ce74,cb5b5a6c,cb5b5b1c,0,caf60340,c0477af6,cb5b5a6c,c06ca040,4,0)
 
 at netbsd:glxsb_crypt
 o_newsession+0x131
 
crypto_newsession(cb5b5b64,cb5b5b1c,1,c03ee300,62d,c044b6d4,cb5b5adc,0,c029f797,cb579860)
 
 at netbsd:crypto_newsessi
 on+0xac
 
cryptodev_session(c0d66f00,cb5b5c60,cb5b5bac,c03b5b56,c06d09a0,c04719c0,cb5b5bac,c0427098,c04719c0,c0d66f00)
 
 at net
 bsd:cryptodev_session+0x3f3
 cryptof_ioctl(cb4feec0,c0206370,cb5b5c60,0,c028f794,cb579860,7,c06cba14,3,0) 
 at netbsd:cryptof_ioctl+0x78
 sys_ioctl(cb579860,cb5b5d00,cb5b5d28,3,c0206370,bb8120d0,b,c03759f6,0,0) 
 at netbsd:sys_ioctl+0x13f
 syscall(cb5b5d48,b3,ab,1f,1f,bb8120f0,b,bfbfb6b8,bbb99420,bb8120d0) at 
 netbsd:syscall+0xbd
 db{0}>
 db{0}> show reg
 ds          0x10
 es          0x10
 fs          0x30
 gs          0x10
 edi         0xc03daf74  __func__.7295
 esi         0xc04063c2  copyright+0x18c22
 ebp         0xcb5b57ec
 ebx         0x104
 edx         0x8
 ecx         0x6
 eax         0x1
 eip         0xc033879c  breakpoint+0x4
 cs          0x8
 eflags      0x246
 esp         0xcb5b57ec
 ss          0x10
 netbsd:breakpoint+0x4:  popl    %ebp
 db{0}>
 db{0}> show lock crypto_mtx
 lock address : 0x00000000c0477af4 type     :               spin
 initialized  : 0x00000000c0113304
 shared holds :                  0 exclusive:                  1
 shares wanted:                  0 exclusive:                  0
 current cpu  :                  0 last held:                  0
 current lwp  : 0x00000000cb579860 last held: 0x00000000cb579860
 last locked  : 0x00000000c0117945 unlocked : 0x00000000c0118aa9
 owner field  : 0x0000000000010600 wait/spin:                0/1
 db{0}>
 db{0}> show lock rndpool_mtx
 lock address : 0x00000000c047fb2c type     :     sleep/adaptive
 initialized  : 0x00000000c0258354
 shared holds :                  0 exclusive:                  0
 shares wanted:                  0 exclusive:                  1
 current cpu  :                  0 last held:                  0
 current lwp  : 0x00000000cb579860 last held: 000000000000000000
 last locked  : 0x00000000c0257dff unlocked : 0x00000000c03610bc
 owner field  : 000000000000000000 wait/spin:                0/0
 
 Turnstile chain at 0xc06cbee0.
 => No active turnstile for this lock.
 db{0}>
 
 
 
 gdb netbsd.gdb:
 
 (gdb) # address from "last locked"
 (gdb) list *(0x00000000c0117945)
 0xc0117945 is in cryptodev_session 
 (/usr/cvs/src-5/sys/opencrypto/cryptodev.c:1615).
 1610                    }
 1611            }
 1612
 1613            /* crypto_newsession requires that we hold the mutex. */
 1614            mutex_spin_enter(&crypto_mtx);
 1615            error = crypto_newsession(&sid, crihead, crypto_devallowsoft);
 1616            if (!error) {
 1617                    DPRINTF(("cyrptodev_session: got session %d\n", 
(uint32_t)sid));
 1618                    cse = csecreate(fcr, sid, crie.cri_key, crie.cri_klen,
 1619                        cria.cri_key, cria.cri_klen, (txform ? sop->cipher 
: 0), sop->mac,
 (gdb)
 
 (gdb) # line from panic message
 (gdb) list *(cryptodev_session+0x3f3)
 0xc0117963 is in cryptodev_session 
 (/usr/cvs/src-5/sys/opencrypto/cryptodev.c:1616).
 1611            }
 1612
 1613            /* crypto_newsession requires that we hold the mutex. */
 1614            mutex_spin_enter(&crypto_mtx);
 1615            error = crypto_newsession(&sid, crihead, crypto_devallowsoft);
 1616            if (!error) {
 1617                    DPRINTF(("cyrptodev_session: got session %d\n", 
(uint32_t)sid));
 1618                    cse = csecreate(fcr, sid, crie.cri_key, crie.cri_klen,
 1619                        cria.cri_key, cria.cri_klen, (txform ? sop->cipher 
: 0), sop->mac,
 1620                        (tcomp ? sop->comp_alg : 0), txform, thash, tcomp);
 (gdb)