kern/46168: /usr/tests/lib/libpthread/t_cond somtimes unkillable

[Manuel.Bouyer%lip6.fr@localhost]

>Number:         46168
>Category:       kern
>Synopsis:       /usr/tests/lib/libpthread/t_cond somtimes unkillable
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Mar 10 16:50:00 +0000 2012
>Originator:     Manuel Bouyer
>Release:        NetBSD 6.99.3
>Organization:
>Environment:
System: NetBSD xen1.soc.lip6.fr 6.99.3 NetBSD 6.99.3 (GENERIC_DEBUG) #6: Sat 
Mar 10 16:29:53 CET 2012 
bouyer@hop:/dsk/l1/misc/bouyer/tmp/amd64/obj/dsk/l1/misc/bouyer/quota2/src/sys/arch/amd64/compile/GENERIC_DEBUG
 amd64
kernel with GENERIC+options DEBUG and the kmem_guard_depth setting as in
kmem(9).
Architecture: x86_64
Machine: amd64 (4-core with hyperthreading enabled Xeon system)
userland from recent netbsd-6
>Description:
        /usr/tests/lib/libpthread/t_cond:cond_timedwait_race sometimes hang,
        with an unkillable t_cond process:
xen1:/home/bouyer>ps axsw |grep t_cond
  0 4066 1673 2578  20    2  43  0 93804  1628 -        U-   ttyp1 0:00.17 
(t_cond)
  0 4066 1673 2578   8    2  85  0 93804  1628 lwpwait  D-   ttyp1 0:00.17 
(t_cond)
xen1:/home/bouyer>ps axsuw | grep t_cond
root    4066  0.0  0.0 93804  1628 ttyp1 DEl   5:27PM 0:00.17 (t_cond)
root    4066  0.0  0.0 93804  1628 ttyp1 DEl   5:27PM 0:00.17 (t_cond)

        from ddb:
db{0}> ps
PID    LID S CPU     FLAGS       STRUCT LWP *              NAME WAIT
611      1 3   3        80   fffffe81b54c4c00               tcsh ttyraw
4162     1 3   0        80   fffffe81af6c2800                 vi ttyraw
4363     1 3   0        80   fffffe81b653dc00                 sh wait
4066    20 8   1         0   fffffe81ae6c2000             t_cond
4066     8 3   0  10000000   fffffe81b7c4b800             t_cond lwpwait
db{0}> tr/a 0xfffffe81ae6c2000
trace: pid 4066 lid 20 at 0x0
db{0}> tr/a 0xfffffe81b7c4b800
trace: pid 4066 lid 8 at 0xfffffe810c5e8a10
sleepq_block() at netbsd:sleepq_block+0xa4
cv_wait() at netbsd:cv_wait+0x101
lwp_wait1() at netbsd:lwp_wait1+0x274
exit_lwps() at netbsd:exit_lwps+0x108
exit1() at netbsd:exit1+0x5c
sys_exit() at netbsd:sys_exit+0x3e
syscall() at netbsd:syscall+0xac

>How-To-Repeat:
        I can reproduce it reliably by running
        atf-run |&tee /tmp/run | atf-report |&tee /tmp/report
        in /usr/tests/lib/libpthread as root. Running just
        atf-run | atf-report
        doesn not reproduce it.
        /tmp is not a separate filesystem; / is a regular ffs filesystem.
>Fix: