kern/58466: Kernel panic in ucompoll

[stix%stix.id.au@localhost]

>Number:         58466
>Category:       kern
>Synopsis:       Kernel panic in ucompoll
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jul 25 04:25:00 +0000 2024
>Originator:     Paul Ripke
>Release:        NetBSD 10.0_STABLE ~2024-06-26
>Organization:
Paul Ripke
"Great minds discuss ideas, average minds discuss events, small minds
 discuss people."
-- Disputed: Often attributed to Eleanor Roosevelt. 1948.
>Environment:
	
	
System: NetBSD slave 10.0_STABLE NetBSD 10.0_STABLE (SLAVE) #10: Wed Jun 26 09:22:33 AEST 2024 stix@slave:/home/netbsd/netbsd-10/obj.amd64/home/netbsd/netbsd-10/src/sys/arch/amd64/compile/SLAVE amd64
Architecture: x86_64
Machine: amd64
>Description:
Kernel panic in ucompoll, when unlocking xscreensaver (?!? coincidence??)
I've seen this a few times now, unfortunately never got a dump.

Jul 24 21:48:55 slave /netbsd: [ 2260291.0658539] uvm_fault(0xffff92260e431b38, 0x0, 1) -> e
Jul 24 21:48:55 slave /netbsd: [ 2260291.0658539] fatal page fault in supervisor mode
Jul 24 21:48:55 slave /netbsd: [ 2260291.0658539] trap type 6 code 0 rip 0xffffffff804957ff cs 0x8 rflags 0x10246 cr2 0xe8 ilevel 0 rsp 0xffffcb8450369bf0
Jul 24 21:48:55 slave /netbsd: [ 2260291.0658539] curlwp 0xffff9226569840c0 pid 2195.2810 lowest kstack 0xffffcb84503652c0
Jul 24 21:48:55 slave /netbsd: [ 2260291.0658539] panic: trap
Jul 24 21:48:55 slave /netbsd: [ 2260291.0658539] cpu0: Begin traceback...
Jul 24 21:48:55 slave /netbsd: [ 2260291.0658539] vpanic() at netbsd:vpanic+0x183
Jul 24 21:48:55 slave /netbsd: [ 2260291.0668541] panic() at netbsd:panic+0x3c
Jul 24 21:48:55 slave /netbsd: [ 2260291.0678538] trap() at netbsd:trap+0xbaf
Jul 24 21:48:55 slave /netbsd: [ 2260291.0678538] --- trap (number 6) ---
Jul 24 21:48:55 slave /netbsd: [ 2260291.0678538] ucompoll() at netbsd:ucompoll+0x2a
Jul 24 21:48:55 slave /netbsd: [ 2260291.0688538] cdev_poll() at netbsd:cdev_poll+0x87
Jul 24 21:48:55 slave /netbsd: [ 2260291.0698538] spec_poll() at netbsd:spec_poll+0x6a
Jul 24 21:48:55 slave /netbsd: [ 2260291.0698538] VOP_POLL() at netbsd:VOP_POLL+0x5d
Jul 24 21:48:55 slave /netbsd: [ 2260291.0708538] sel_do_scan() at netbsd:sel_do_scan+0x3ba
Jul 24 21:48:55 slave /netbsd: [ 2260291.0718537] selcommon() at netbsd:selcommon+0x18c
Jul 24 21:48:55 slave /netbsd: [ 2260291.0718537] sys___select50() at netbsd:sys___select50+0x75
Jul 24 21:48:55 slave /netbsd: [ 2260291.0728538] syscall() at netbsd:syscall+0x1fc
Jul 24 21:48:55 slave /netbsd: [ 2260291.0728538] --- syscall (number 417) ---
Jul 24 21:48:55 slave /netbsd: [ 2260291.0738538] netbsd:syscall+0x1fc:
Jul 24 21:48:55 slave /netbsd: [ 2260291.0738538] cpu0: End traceback...


Do we dump the x86 error code from page faults? I'm not seeing it above.
Given the code in ucompoll, I'm wondering if it was on instruction fetch...
although thinking again, cr2 being 0xe8, it's probably the offset of the
function pointer in the struct, with nullptr base address.

>How-To-Repeat:
Unknown.

>Fix:
Unknown.

>Unformatted: