kern/40161: kernel crash when using gdb

[christos%zoulas.com@localhost]

>Number:         40161
>Category:       kern
>Synopsis:       kernel crash when using gdb.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Dec 12 21:15:00 +0000 2008
>Originator:     Christos Zoulas
>Release:        NetBSD 5.99.5
>Organization:
        Don't panic, Inc.
>Environment:
System: NetBSD t61.localnet 5.99.5 NetBSD 5.99.5 (T61) #0: Wed Dec 10 19:35:34 
EST 2008 ljt%t61.localnet@localhost:/s/NetBSD/obj/sys/arch/amd64/compile/T61 
amd64

Architecture: amd64
Machine: amd64
>Description:
        Any user can crash the system from gdb:
        http://www.zoulas.com/NetBSD/IMGP05{48,49,50,52}.JPG

>How-To-Repeat:

First, build UDFclient 0.6.3 (from pkgsrc/misc/udfclient) with
debugging symbols.  (The crash probably also occurs without debugging,
but I haven't checked.)  Then, from a terminal, do

------------------------------------------------------------------------
  0 ljt:staff@t61//tmp$ gdb udfclient 
  GNU gdb 6.5
  Copyright (C) 2006 Free Software Foundation, Inc.
  GDB is free software, covered by the GNU General Public License, and you are
  welcome to change it and/or distribute copies of it under certain conditions.
  Type "show copying" to see the conditions.
  There is absolutely no warranty for GDB.  Type "show warranty" for details.
  This GDB was configured as "x86_64--netbsd"...
  (gdb) break udfclient_ls
  Breakpoint 1 at 0x4026e8: file udfclient.c, line 320.
  (gdb) run /dev/cd0d

          [ ... program output ... ]
          mapping 0 on 0 as direct recording data metadata



  Program received signal SIGTRAP, Trace/breakpoint/trap.
  0x00007f7ffd933bda in _lwp_park () from /usr/lib/libc.so.12
  (gdb) bt
  #0  0x00007f7ffd933dba in _lwp_park () from /usr/lib/libc.so.12
  #1  0x00007f7ffdc09415 in pthread_cond_timedwait()
     from /usr/lib/libpthread.so.0
  #2  0x000000000042039d in udf_purger (arg=0x0) at udf_unix.c:442
  #3  0x00007f7ffcd0b672 in pthread_create () from /usr/lib/libpthread.so.0
  #4  0x00007f7ffd953b50 in swapcontext () from /usr/lib/libc.so.12
  #5  0x00007f7ffdfe7040 in ?? ()
  #6  0x0000000000000000 in ?? ()
  (gdb) quit
  The program is running.  Exit anyway? (y or n) y
  panic: kernel diagnostic assertion "sigismember(&sp->sp_set, signo)" failed: 
file "/p/src/sys/kern/kern_sig.c", line 518
  fatal breakpoint trap in supervisor mode
  trap type 1 code 0 rip ffffffff80227015 cs 8 rflags 246 cr2  ffff800049bc4000 
cpl 0 rsp ffff800049609960
  Stopped in pid 23858.1 (udfclient) at   netbsd:breakpoint+0x5:  leave
  db{0}> bt
  breakpoint() at netbsd:breakpoint+0x5
  panic() at netbsd:panic+0x260
  __kernassert() at netbsd:__kernassert+0x2d
  sigget() at netbsd:sigget+0x19a
  postsig() at netbsd:postsig+0xaf
  lwp_useret() at netbsd:lwp_useret+0x177
  trap() at netbsd:trap+0x8d0
  uvm_fault(0xffff8000497ec178, 0x0, 1) -> e
  fatal page fault in supervisor mode
  trap type 6 code 0 rip ffffffff8024457b cs 8 rflags 10247 cr2  b8 cpl 8 rsp 
ffff800049609360
  kernel: page fault trap, code=0
  Faulted in DDB; continuing...
  db{0}>
>Fix:
        ?