kern/45482: compat_linux: panic: trap in linux_ioctl_socket()

[he%NetBSD.org@localhost]

>Number:         45482
>Category:       kern
>Synopsis:       compat_linux: panic: trap in linux_ioctl_socket()
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Oct 18 12:50:00 +0000 2011
>Originator:     Havard Eidnes
>Release:        NetBSD 5.1_RC3
>Organization:
        I Try, Inc.
>Environment:
System: NetBSD mail-server.nordu.net 5.1_RC3 NetBSD 5.1_RC3 (MAIL-SERVER) #0: 
Sun Jul  4 01:07:08 CEST 2010  
root%mail-server.nordu.net@localhost:/usr/obj/sys/arch/i386/compile/MAIL-SERVER 
i386
Architecture: i386
Machine: i386
>Description:
        We try to use a backup client which runs Linux binaries.
        Lately we've found that when the backup server tries to
        initiate a backup, the machine to be backed up panics and
        reboots.

        The messages printed in the console log are:

uvm_fault(0xc0c09bc0, 0xfffff000, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c07a0977 cs 8 eflags 10213 cr2 fffffff8 ilevel 0
panic: trap
Begin traceback...
End traceback...

        %eip points towards linux_ioctl_socket+87 (or +0x57).
        Looking at the disassembly, this appears to be in the function
        epilogue:

0xc07a0977 <linux_ioctl_socket+87>:     mov    0xfffffff8(%ebp),%esi
0xc07a097a <linux_ioctl_socket+90>:     mov    0xfffffff4(%ebp),%ebx
0xc07a097d <linux_ioctl_socket+93>:     mov    0xfffffffc(%ebp),%edi
0xc07a0980 <linux_ioctl_socket+96>:     mov    %ebp,%esp
0xc07a0982 <linux_ioctl_socket+98>:     pop    %ebp
0xc07a0983 <linux_ioctl_socket+99>:     ret    

        In DDB, no backtrace information is available either, but
        "show registers" shows that %ebp is 0, which can't be good.

        I'm not able to see anything in the disassembly of
        linux_ioctl_socket() which would reset %ebp to zero, but it's
        conceivable that I've overlooked something.

        The same problem can be provoked by trying to run the opera
        web browser -- it will also trigger an instant panic.

        Assistance to find and fix this problem would be much
        appreciated.

        The versions of suse compat packages installed are:

mail-server% pkg_info | egrep suse
suse_base-10.0nb5   Linux compatibility package
suse_compat-10.0nb3 Linux compatibility package with old shared libraries
mail-server% 

>How-To-Repeat:
        It's probably easiest to reproduce this problem by trying to
        run the opera web browser, version 11.01.

>Fix:
        Don't know.