kern/46275: Kernel panics on heavy use, kevent / pipes related?

[reinoud%NetBSD.org@localhost]

>Number:         46275
>Category:       kern
>Synopsis:       Kernel panics on heavy use, kevent / pipes related?
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 28 15:25:01 +0000 2012
>Originator:     Reinoud Zandijk
>Release:        NetBSD 6.0_BETA
>Organization:
NetBSD
>Environment:
NetBSD heethoofdje.13thmonkey.org 6.0_BETA NetBSD 6.0_BETA (GENERIC) #0: Sat 
Mar 24 22:55:30 CET 2012  
reinoud%heethoofdje.13thmonkey.org@localhost:/usr/sources/cvs.netbsd.org/src-6/sys/arch/i386/compile/GENERIC
 i386

>Description:
When compiling Haskell packages, the machine can suddenly reset. First i 
thought it might be memory related but further investigation showed that it 
kept crashing at exactly the same place. Therefore i inserted assertions to 
test what NULL pointer got dereferenced and today it struck at the same place 
as usual, only now in one of my asserts:

panic: kernel assertion "((file_t *) kn->kn_obj)->f_data" failed: file 
"../../../../kern/sys_pipe.c", line 1387
cpu0: Begin traceback...
kern_assert(c0b706b0,c0c19753,c0c045d0,c0c043f0,56b,4c,dde1bacc,c07abc3d,c57a2b80,c5857d20)
 at netbsd:kern_assert+0x23
filt_piperead(c5b9caf0,0,c0c40800,c0564afc,c5857d20,0,dde1bafc,c055e78d,c0c40800,c2f91d20)
 at netbsd:filt_piperead+0x1af
kevent1(dde1bd1c,4,0,0,bb7fc010,40,0,c0b11490,dde1bd48,c0c997cc) at 
netbsd:kevent1+0x61d
sys___kevent50(c5857d20,dde1bcf4,dde1bd1c,c0652ea7,db7e3dc0,0,c5857d20,c5617440,c068fc65,c5617454)
 at netbsd:sys___kevent50+0x45
syscall(dde1bd48,99700b3,bb4000ab,bfbf001f,bbad001f,bb723600,bb400000,bb5fdcb4,bbb8f178,9da95fc)
 at netbsd:syscall+0xad
cpu0: End traceback...

The code is around src/sys/kern/sys_pipe.c:1355

static void
filt_pipedetach(struct knote *kn)
{
        struct pipe *pipe;
        kmutex_t *lock;

        pipe = ((file_t *)kn->kn_obj)->f_data;
        lock = pipe->pipe_lock;
*panic* due to deference of NULL struct pipe*

        mutex_enter(lock);


>How-To-Repeat:
Do heavy compilation work, like ghc Haskell and some Haskell packages and it 
can show up. No idea why it showed up in Haskell, but maybe its using some form 
of pipe-snooping.
>Fix:
unknoen