Re: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed

[Thomas Klausner <tk%giga.or.at@localhost>]

Hi!

On Sun, Jun 14, 2020 at 09:49:57PM +0000, Andrew Doran wrote:
> Hi,
> 
> On Fri, Jun 12, 2020 at 11:17:30PM +0200, Thomas Klausner wrote:
> 
> > With a 9.99.63/amd64 kernel from May 19 I saw a panic:
> > 
> > Jun  7 01:01:01 yt savecore: reboot after panic: [ 396809.5836453] panic: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed: file "/usr/src/sys/kern/kern_timeout.c", line 322 running callout 0xffff835adaa87658: c_func (0xffffffff809f459f) c_flags (0x100) destroyed from 0xffffffff809f264b
> > Jun  7 01:01:01 yt savecore: writing compressed core to /var/crash/netbsd.12.core.gz
> > 
> > (gdb) bt
> > #0  0xffffffff80226865 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:713
> > #1  0xffffffff80cd387f in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:73
> > #2  0xffffffff80d1285e in vpanic (
> >     fmt=0xffffffff8143e908 "kernel %sassertion \"%s\" failed: file \"%s\", line %d running callout %p: c_func (%p) c_flags (%#x) destroyed from %p", 
> >     ap=ap@entry=0xffff850916323c88) at /usr/src/sys/kern/subr_prf.c:290
> > #3  0xffffffff80e834b6 in kern_assert (
> >     fmt=fmt@entry=0xffffffff8143e908 "kernel %sassertion \"%s\" failed: file \"%s\", line %d running callout %p: c_func (%p) c_flags (%#x) destroyed from %p")
> >     at /usr/src/sys/lib/libkern/kern_assert.c:51
> > #4  0xffffffff80cf1708 in callout_destroy (cs=cs@entry=0xffff835adaa87658) at /usr/src/sys/kern/kern_timeout.c:323
> > #5  0xffffffff809f264b in tcp_close (tp=tp@entry=0xffff835adaa874c8) at /usr/src/sys/netinet/tcp_subr.c:1227
> > #6  0xffffffff809ecb83 in tcp_input (m=0xffff83415e784b00, off=20, proto=<optimized out>) at /usr/src/sys/netinet/tcp_input.c:2396
> > #7  0xffffffff809dde5f in ip_input (m=<optimized out>) at /usr/src/sys/netinet/ip_input.c:816
> > #8  ipintr (arg=<optimized out>) at /usr/src/sys/netinet/ip_input.c:402
> > #9  0xffffffff80ce18ae in softint_execute (s=4, l=0xffff835d46efb480) at /usr/src/sys/kern/kern_softint.c:565
> > #10 softint_dispatch (pinned=<optimized out>, s=4) at /usr/src/sys/kern/kern_softint.c:814
> > #11 0xffffffff80220eef in Xsoftintr ()
> > (gdb)
> > 
> > Is this probably already fixed or should I file a PR?
> >  Thomas
> 
> I had a brief look at this before but I don't know the networking code too
> well.  Basically something is starting a TCP timer after/during its
> destruction.  It seems to be a old bug but whatever you're doing is managing
> to trigger it.  It's definitely worth a PR.

Thanks for the feedback. I've filed kern/55387 for it.

It was in the night, so I wasn't doing anything myself and didn't
trigger it myself. There were a couple processes running, I put the
details as far as I remembered into the PR.

I still have the core dump and debugging kernel in case someone wants
to investigate some details.
 Thomas