kern/46522: wscons: deleting a screen causes kernel crash

[nathanialsloss%yahoo.com.au@localhost]

>Number:         46522
>Category:       kern
>Synopsis:       wscons: deleting a screen causes kernel crash
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jun 02 15:50:00 +0000 2012
>Originator:     Nat Sloss
>Release:        NetBSD Current 6.99.6
>Organization:
>Environment:
NetBSD beast 6.99.6 NetBSD 6.99.6 (LOCKDEBUG) #54: Sat Jun  2 17:32:26 EST 2012 
 build@beast:/usr/src/sys/arch/i386/compile/obj/LOCKDEBUG i386

>Description:
In my configuration 4 virtual screens are created at startup as specified in 
wscons.conf.

I thought I could change the resolution of one of the sreens (this is not the 
case as I have since discovered) and whilst attempting to delete one of the 
four screens the kernel crashed.  This happens whether a getty is running on 
that screen or not.

The following debug output was obtained:

test# wsconscfg -dF 3
Condition variable error: lockdebug_free: is locked or in use

lock address : 0x00000000c1349828 type     :               spin
initialized  : 0x00000000c07af190 interlock: 0x00000000c0c5a7d0

panic: LOCKDEBUG
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c025c1a4 cs 8 eflags 282 cr2 bbbd30d4 ilevel 0
Stopped in pid 531.1 (wsconscfg) at     netbsd:breakpoint+0x4:  popl    %ebp
db{0}> bt
breakpoint(c0b68789,c0c1a940,c0b59f5d,c82bb838,0,c144fc80,c14a1800,c174374c,0,c0
ac323a) at netbsd:breakpoint+0x4
vpanic(c0b59f5d,c82bb838,c82bb86c,c1743740,0,c0ac323a,c82bb86c,c0759df4,c0b59f5d
,c0b27db6) at netbsd:vpanic+0x1e2
printf_nolog(c0b59f5d,c0b27db6,c0ac323a,c0b59f67,c1422d40,c0b89814,1ac3148,c0b59
f67,c117d4cc,c0c5a7d0) at netbsd:printf_nolog
lockdebug_more(c0b59f67,1,ffffffff,c0c5a7d0,c1349878,c1349834,c0b89814,c07af482,
c14a1800,400) at netbsd:lockdebug_more
lockdebug_free(c1349828,0,6,c117d4cc,3,c121bcac,c0c513c4,c13498b0,c1349860,c1349
8a4) at netbsd:lockdebug_free+0xc9
tty_free(c1349800,c0c19ba0,c074eb25,2f,c117d700,c074cf53,6,c121bcac,3,c121bcac) 
a
t netbsd:tty_free+0x197
wsscreen_detach(c121bcac,8008574f,c0c19ba0,c0517ce4,c0c19ba2,c074cf53,0,c124be40
,0,c1248200) at netbsd:wsscreen_detach+0x24
wsdisplay_delscreen(c124be40,3,1,c074eb5b,c0c19ba0,0,2fff,ff,c1248200,8008574f) 
a
t netbsd:wsdisplay_delscreen+0xa6
wsdisplay_cfg_ioctl(c124be40,8008574f,c82bbc24,3,c1422d40,c1422d40,c14af4c0,c14a
f4c0,c0ad01a0,c1422d40) at netbsd:wsdisplay_cfg_ioctl+0x7d
cdev_ioctl(2fff,0,8008574f,c82bbc24,3,c1422d40,3,2000,0,c0854f44) at netbsd:cdev
_ioctl+0x9a
spec_ioctl(c82bbabc,0,c0854f44,c14af4c0,c1422d40,0,c82bbaec,c08c485c,0,c18dca00)
 at netbsd:spec_ioctl+0xdd
VOP_IOCTL(c14b8790,8008574f,c82bbc24,3,c1199540,c140c59c,c82bbb4c,c075a4bb,c18dc
a0c,c140c59c) at netbsd:VOP_IOCTL+0x3e
vn_ioctl(c140c580,8008574f,c82bbc24,c0759b52,0,c19041c0,c0acf9d8,c075f570,6,10) 
a
t netbsd:vn_ioctl+0x68
sys_ioctl(c1422d40,c82bbcf4,c82bbd1c,c12f785c,0,c12fcc6c,bbbd30d4,36,c12f785c,2)
 at netbsd:sys_ioctl+0x1b2
syscall(c82bbd48,bbbc00b3,ab,bfbf001f,bbbc001f,0,0,bfbfedb8,0,bfbfed94) at netbs
d:syscall+0x95


Note: the addresses of the tty functions will be different as my kern/tty.c was 
modified in an attempt to fix the problem with no effect.
>How-To-Repeat:
wsconscfg -dF 3

Attempt to delete screen 3.
>Fix: