kern/45415: ptyfs crashes -current

[martin%NetBSD.org@localhost]

>Number:         45415
>Category:       kern
>Synopsis:       ptyfs crashes -current
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Oct 03 13:45:00 +0000 2011
>Originator:     Martin Husemann
>Release:        NetBSD 5.99.56
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD after-hours.aprisoft.de 5.99.56 NetBSD 5.99.56 (MODULAR) #56: 
Mon Oct 3 10:39:42 CEST 2011 
martin%after-hours.aprisoft.de@localhost:/usr/src/sys/arch/sparc64/compile/MODULAR
 sparc64
Architecture: sparc64
Machine: sparc64
>Description:

I mount a ptyfs on /dev/pts, using the ptyfs kernel module, auto-loaded on
mount time.

As soon as I try to log in, the system crashes:

kernel trap 30: data access exception
Stopped in pid 388.1 (rxvt) at  netbsd:pty_grant_slave+0x40:    ld [%g1 + 
0x60], %g1
db{1}> bt
cdev_ioctl(1500, 20007447, eaefca0, 3, eb31c00, b) at netbsd:cdev_ioctl+0x6c
VOP_IOCTL(f141e60, 20007447, eaefca0, 3, 39ce600, 0) at netbsd:VOP_IOCTL+0x5c
vn_ioctl(3, 20007447, eaefca0, 1, 0, 40415308) at netbsd:vn_ioctl+0x50
sys_ioctl(eb31c00, eaefdd0, eaefe10, 1, 0, 40414f28) at netbsd:sys_ioctl+0x194
syscall_plain(eaefed0, eaefdd0, 40a45b18, ffffffffffffacb1, 40a45b18, 3) at 
netbsd:syscall_plain+0x134

This is the code location, apparently:

(gdb) list *(pty_grant_slave+0x40)
0x147e3c0 is in pty_grant_slave (../../../../kern/tty_ptm.c:205).
200             if (ptm == NULL)
201                     return EOPNOTSUPP;
202             if ((error = (*ptm->allocvp)(ptm, l, &vp, dev, 't')) != 0)
203                     return error;
204     
205             if ((vp->v_mount->mnt_flag & MNT_RDONLY) == 0) {
206                     struct vattr vattr;
207                     (*ptm->getvattr)(ptm, l, &vattr);
208                     /* Do the VOP_SETATTR() as root. */
209                     error = VOP_SETATTR(vp, &vattr, lwp0.l_cred);

The unaligned access probably means vp->v_mount is broken.

>How-To-Repeat:
s.a.

>Fix:
n/a