>Number:         36170
>Category:       kern
>Synopsis:       panic: closef: usecount < 1
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Apr 19 03:05:00 +0000 2007
>Originator:     dap@ex-zardoz.damon.com
>Release:        NetBSD 4.99.17
>Organization:
dis-organised
>Environment:
	
	
System: NetBSD zardoz.damon.com 4.99.17 NetBSD 4.99.17 (ZARDOZ) #0: Wed Apr 18 15:27:38 EST 2007 dap@zardoz.damon.com:/home/dap/proj/3.1/obj/sys/arch/i386/compile/ZARDOZ i386
Architecture: i386
Machine: i386
>Description:
	#13 0xc028dbc4 in panic (fmt=0xc03e4766 "closef: usecount < 1") at /home/dap/proj/3.1/src/sys/kern/subr_prf.c:246
	bootopt = 256
	ap = 0xccd1fb98 "\205E>?z\005"
	intrace = 0
	#14 0xc025f38f in closef (fp=0xcd352bec, l=0xccd216a0) at /home/dap/proj/3.1/src/sys/kern/kern_descrip.c:1414
	p = <value optimized out>
	lf = {l_start = 2794954048901, l_len = 3224001891, l_pid = 0, l_type = 5, l_whence = 0}
	error = <value optimized out>
	#15 0xc02aaa06 in sys_accept (l=0xccd216a0, v=0xccd1fc48, retval=0xccd1fc68) at /home/dap/proj/3.1/src/sys/kern/uipc_syscalls.c:252
	fdp = (struct filedesc *) 0xcccda740
	fp = (struct file *) 0xcd352bec
	nam = (struct mbuf *) 0xc1c36400
	namelen = 16
	error = 0
	s = 0
	fd = 11
	fflag = <value optimized out>
	#16 0xc02f7339 in syscall_plain (frame=0xccd1fc88) at /home/dap/proj/3.1/src/sys/arch/i386/i386/syscall.c:148
	params = <value optimized out>
	callp = (const struct sysent *) 0xc0431de8
	l = (struct lwp *) 0xccd216a0
	p = <value optimized out>
	error = <value optimized out>
	code = <value optimized out>
	args = {6, -1077941004, -1077940988, -1077940904, -1077940808, 0, 0, -877877896}
	rval = {11, 0}
	#17 0xc0100718 in syscall1 ()
	No symbol table info available.

Attempts to get the proc list fail:
	zardoz# ps -M /fs/2/crash/netbsd.3.core -N /fs/2/crash/netbsd.3 
	ps: can't read pgrp at 0x0: Undefined error: 0

The fp:

(gdb) p fp
$1 = (struct file *) 0xcd352bec
(gdb) p *fp
$2 = {f_list = {le_next = 0xcd3526ac, le_prev = 0xccc74350}, f_flag = 7, f_iflags = 3, f_advice = 0, f_type = 2, f_count = 0, f_msgcount = 0, 
  f_usecount = 0, f_cred = 0xcceb3778, f_ops = 0xc0434ae0, f_offset = 0, f_data = 0xc21a96ec, f_slock = {lock_data = 1 '\001', 
      lock_pad = "\000\000", lock_file = 0xc03e4585 "/home/dap/proj/3.1/src/sys/kern/kern_descrip.c", 
  unlock_file = 0xc03ecc40 "/home/dap/proj/3.1/src/sys/kern/uipc_syscalls.c", lock_line = 1402, unlock_line = 235, list = {tqe_next = 0x0, 
	tqe_prev = 0xc043374c}, lock_holder = 0}}
(gdb) p *fp->f_ops
$3 = {fo_read = 0xc02968d8 <soo_read>, fo_write = 0xc02968f8 <soo_write>, fo_ioctl = 0xc0296a9a <soo_ioctl>, fo_fcntl = 0xc0296921 <soo_fcntl>, 
  fo_poll = 0xc0296999 <soo_poll>, fo_stat = 0xc029695f <soo_stat>, fo_close = 0xc0296934 <soo_close>, fo_kqfilter = 0xc02a5459 <soo_kqfilter>}


>How-To-Repeat:
	
>Fix: