kern/37950: Unmounting psshfs immediately panics the machine

[jmmv%netbsd.org@localhost]

>Number:         37950
>Category:       kern
>Synopsis:       Unmounting psshfs immediately panics the machine
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 04 13:20:01 +0000 2008
>Originator:     Julio M. Merino Vidal
>Release:        NetBSD current (with sources from 20080203)
>Organization:
>Environment:
        
        
Architecture: amd64
Machine: x86_64
>Description:
        When mounting and then unmounting a psshfs (and supposedly any puffs
        file system), the system immediately panics with:

uvm_fault(0xc0a8d360, 0xcc433000, 2) -> 0xe
kernel: supervisor trap page fault, code=0
Stopped in pid 1039.1 (umount) at netbsd:atomic_dec_uint_nv+0x9: lock xaddl 
%eax,0(%edx)
db{0}> bt
atomic_dec_uint_nv(cc433000,0,cc382780,c04911d0,cc48bf28) at 
netbsd:atomic_dec_uint_nv+0x9
dounmount(cc433000,0,cc4015a0,cc433000,0) at netbsd:dounmount+0x1d7
sys_unmount(cc4015a0,cc436d00,cc436d28,bba00000,bba00000) at 
netbsd:sys_unmount+0x123
syscall(cc436d48,b3,ab,1f,1f) at netbsd:syscall+0x134
db{0}>

        With a diagnostic kernel, the panic is completely different:

panic: kmem_poison_check: 0xffff800024d1c060: 0x53 != 0x54

Stopped in pid 1135.1 (mount_psshfs) at netbsd:breakpoint+0x1: ret
db{1}> bt
breakpoint() at netbsd:breakpoint+0x1
kmem_poison_check() at netbsd:kmem_poison_check+0x82
kmem_backend_free() at netbsd:kmem_backend_free+0x3d
amap_free() at netbsd:amap_free+0x64
uvm_unmap_detach() at netbsd:uvm_unmap_detach+0x4e
uvmspace_free() at netbsd:uvmspace_free+0x106
exit1() at netbsd:exit1+0x249
sys_exit() at netbsd:sys_exit+0x67
syscall() at netbsd:syscall+0xa9

        This is all with a GENERIC kernel using the following GENERIC.local
        file:

file-system     PUFFS           # experimental - Userspace file system support
pseudo-device   putter

options         MODULAR
no options      LKM

options         DEBUG
makeoptions     DEBUG="-g"
options         DIAGNOSTIC

>How-To-Repeat:
        mount a psshfs file system and then unmount it.

        For simplicity, do:
        # cd /usr/tests/fs/puffs
        # ./t_psshfs
        boom, panic
>Fix:
        Unknown.

>Unformatted: