panic: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed

[Thomas Klausner <wiz%NetBSD.org@localhost>]

Hi!

Some days ago I had a panic on NetBSD 9.99.81/amd64 with

reboot after panic: [ 779722.8269866] panic: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed: file "/disk/6/archive/foreign/src/sys/kern/kern_timeout.c", line 323 running callout 0xfffffe741440a868: c_func (0xffffffff80a20775) c_flags (0x108) destroyed from 0xffffffff80a1e821

I had this at least once before

https://mail-index.netbsd.org/current-users/2020/02/23/msg037825.html

This time the backtrace was:

(gdb) bt
#0  0xffffffff802261d5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /disk/6/archive/foreign/src/sys/arch/amd64/amd64/machdep.c:713
#1  0xffffffff80cc95e1 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /disk/6/archive/foreign/src/sys/kern/kern_reboot.c:73
#2  0xffffffff80d0939d in vpanic (
    fmt=0xffffffff8145dd78 "kernel %sassertion \"%s\" failed: file \"%s\", line %d running callout %p: c_func (%p) c_flags (%#x) destroyed from %p",
    ap=ap@entry=0xffffde09162cdc88) at /disk/6/archive/foreign/src/sys/kern/subr_prf.c:290
#3  0xffffffff80e7b703 in kern_assert (
    fmt=fmt@entry=0xffffffff8145dd78 "kernel %sassertion \"%s\" failed: file \"%s\", line %d running callout %p: c_func (%p) c_flags (%#x) destroyed from %p") at /disk/6/archive/foreign/src/sys/lib/libkern/kern_assert.c:51
#4  0xffffffff80ce79eb in callout_destroy (cs=cs@entry=0xfffffe741440a868) at /disk/6/archive/foreign/src/sys/kern/kern_timeout.c:323
#5  0xffffffff80a1e821 in tcp_close (tp=tp@entry=0xfffffe741440a6d8) at /disk/6/archive/foreign/src/sys/netinet/tcp_subr.c:1227
#6  0xffffffff80a18386 in tcp_input (m=0xfffffe7f1b77e360, off=<optimized out>, proto=<optimized out>)
    at /disk/6/archive/foreign/src/sys/netinet/tcp_input.c:2446
#7  0xffffffff80a0a0d6 in ip_input (ifp=<optimized out>, m=<optimized out>) at /disk/6/archive/foreign/src/sys/netinet/ip_input.c:811
#8  ipintr (arg=<optimized out>) at /disk/6/archive/foreign/src/sys/netinet/ip_input.c:410
#9  0xffffffff80cd76e0 in softint_execute (s=4, l=0xfffffe8388cff480) at /disk/6/archive/foreign/src/sys/kern/kern_softint.c:565
#10 softint_dispatch (pinned=<optimized out>, s=4) at /disk/6/archive/foreign/src/sys/kern/kern_softint.c:814

and then lots of lines like this:
#50 0x453141c1497141c5 in ?? ()

Last time the backtrace was:

(gdb) bt
#0  0xffffffff80224315 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:720
#1  0xffffffff809f8029 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:61
#2  0xffffffff80a3a039 in vpanic (fmt=0xffffffff8135e9c0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=ap@entry=0xffffbc090722bc88)
    at /usr/src/sys/kern/subr_prf.c:336
#3  0xffffffff80e803f3 in kern_assert (fmt=fmt@entry=0xffffffff8135e9c0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ")
    at /usr/src/sys/lib/libkern/kern_assert.c:51
#4  0xffffffff80a18c12 in callout_destroy (cs=cs@entry=0xffffb28a40220a88) at /usr/src/sys/kern/kern_timeout.c:321
#5  0xffffffff8073dec3 in tcp_close (tp=tp@entry=0xffffb28a40220a68) at /usr/src/sys/netinet/tcp_subr.c:1224
#6  0xffffffff80738419 in tcp_input (m=0xffffb284dcc92a88, off=20, proto=<optimized out>) at /usr/src/sys/netinet/tcp_input.c:2656
#7  0xffffffff80729849 in ip_input (m=<optimized out>) at /usr/src/sys/netinet/ip_input.c:816
#8  ipintr (arg=<optimized out>) at /usr/src/sys/netinet/ip_input.c:402
#9  0xffffffff80a08c12 in softint_execute (s=4, l=0xffffb297fe6f7480, si=0xffffbc0907220230) at /usr/src/sys/kern/kern_softint.c:578
#10 softint_dispatch (pinned=<optimized out>, s=4) at /usr/src/sys/kern/kern_softint.c:885
#11 0xffffffff8021ea4f in Xsoftintr ()

so this seems repeatable.
I've filed a PR for it.
 Thomas