kern/56989: socket locking assertion fails

[martin%NetBSD.org@localhost]

>Number:         56989
>Category:       kern
>Synopsis:       socket locking assertion fails
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 30 14:15:00 +0000 2022
>Originator:     Martin Husemann
>Release:        NetBSD 9.99.99
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD gethsemane.aprisoft.de 9.99.99 NetBSD 9.99.99 (GETHSEMANE) #211: Tue Aug 30 12:15:04 CEST 2022 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/macppc/compile/GETHSEMANE macppc
Architecture: powerpc
Machine: macppc
>Description:

During atf tests the kernel crashed:

[ 3918.3583179] panic: kernel diagnostic assertion "solocked(so)" failed: file "../../../../kern/uipc_usrreq.c", line 409 
[ 3918.3783222] cpu1: Begin traceback...
[ 3918.3783222] 0x199e5d00: at vpanic+0x158
[ 3918.3883269] 0x199e5d30: at kern_assert+0x60
[ 3918.3983322] 0x199e5d70: at unp_rcvd+0x220
[ 3918.4083374] 0x199e5d90: at soreceive+0x63c
[ 3918.4183421] 0x199e5e60: at dofileread+0x88
[ 3918.4283472] 0x199e5eb0: at syscall+0x350

this is:

(gdb) list *(unp_rcvd+0x220)
0x8071b0 is in unp_rcvd (../../../../kern/uipc_usrreq.c:409).
404     {
405             struct unpcb *unp = sotounpcb(so);
406             struct socket *so2;
407             u_int newhiwat;
408     
409             KASSERT(solocked(so));
410             KASSERT(unp != NULL);
411     
412             switch (so->so_type) {
413     
(gdb) list *(soreceive+0x63c)
0x7f8d5c is in soreceive (../../../../kern/uipc_socket.c:1641).
1636                                    so->so_rcv.sb_lastrecord = nextrecord;
1637                    }
1638                    SBLASTRECORDCHK(&so->so_rcv, "soreceive 4");
1639                    SBLASTMBUFCHK(&so->so_rcv, "soreceive 4");
1640                    if (pr->pr_flags & PR_WANTRCVD && so->so_pcb)
1641                            (*pr->pr_usrreqs->pr_rcvd)(so, flags, l);
1642            }
1643            if (orig_resid == uio->uio_resid && orig_resid &&
1644                (flags & MSG_EOR) == 0 && (so->so_state & SS_CANTRCVMORE) == 0) {
1645                    sbunlock(&so->so_rcv);
(gdb) list *(dofileread+0x88)
0x7c67cc is in dofileread (../../../../kern/sys_generic.c:156).
151                     error = EINVAL;
152                     goto out;
153             }
154     
155             cnt = auio.uio_resid;
156             error = (*fp->f_ops->fo_read)(fp, offset, &auio, fp->f_cred, flags);
157             if (error)
158                     if (auio.uio_resid != cnt && (error == ERESTART ||
159                         error == EINTR || error == EWOULDBLOCK))
160                             error = 0;


This looks a tiny bit like PR 55738 (same machine), but I'm not sure.
Don't know if it is reproducable yet - will try and report.

>How-To-Repeat:

as root: cd /usr/tests && atf-run | atf-report
(but not sure if it is reproducable, see above)

>Fix:
na/