kern/38123: mount_smbfs issue

[kefren%ngnetworks.ro@localhost]

>Number:         38123
>Category:       kern
>Synopsis:       mount_smbfs crashes kernel
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Feb 29 08:50:00 +0000 2008
>Originator:     Mihai Chelaru
>Release:        NetBSD 4.99.54
>Organization:
        
>Environment:
        
        
System: NetBSD kemobile.girsa.ro 4.99.54 NetBSD 4.99.54 (Kefren) #2: Wed Feb 27 
23:39:30 EET 2008 
kefren%kemobile.girsa.ro@localhost:/usr/work/src/sys/arch/i386/compile/obj/Kefren
 i386
Architecture: i386
Machine: i386
>Description:
        
        since a couple of months, mount_smbfs crashes the kernel 100% 
reproductible

        Here is the backtrace:

#0  0xc046cff2 in cpu_reboot (howto=260, bootstr=0x0) at 
/usr/work/src/sys/arch/i386/i386/machdep.c:952
#1  0xc03d80fa in panic (fmt=0xc067771c "trap") at 
/usr/work/src/sys/kern/subr_prf.c:260
#2  0xc0471123 in trap (frame=0xcac4f874) at 
/usr/work/src/sys/arch/i386/i386/trap.c:372
#3  0xc01030c8 in calltrap ()
#4  0xc0468351 in db_read_bytes (addr=0, size=4, data=0xcac4f8e4 "") at 
/usr/work/src/sys/arch/i386/i386/db_memrw.c:98
#5  0xc01bb067 in db_get_value (addr=0, size=4, is_signed=false) at 
/usr/work/src/sys/ddb/db_access.c:62
#6  0xc0468bda in db_stack_trace_print (addr=-893060652, have_addr=true, 
count=65535, modif=0xc06aa17a "",
    pr=0xc03d7ed0 <printf>) at /usr/work/src/sys/arch/i386/i386/db_trace.c:484
#7  0xc03d80d0 in panic (fmt=0xc067771c "trap") at 
/usr/work/src/sys/kern/subr_prf.c:249
#8  0xc0471123 in trap (frame=0xcac4fa78) at 
/usr/work/src/sys/arch/i386/i386/trap.c:372
#9  0xc01030c8 in calltrap ()
#10 0xc03de2b2 in seldestroy (sip=0xc14ee270) at 
/usr/work/src/sys/kern/sys_generic.c:1228
#11 0xc03fc595 in sofree (so=0xc14ee1e8) at 
/usr/work/src/sys/kern/uipc_socket.c:626
#12 0xc0134789 in in_pcbdetach (v=0xc1110a8c) at 
/usr/work/src/sys/netinet/in_pcb.c:497
#13 0xc014749a in tcp_close (tp=0xc14ec004) at 
/usr/work/src/sys/netinet/tcp_subr.c:1270
#14 0xc0141f0d in tcp_input (m=0xc1113900) at 
/usr/work/src/sys/netinet/tcp_input.c:2485
#15 0xc0138ceb in ip_input (m=0xc1113900) at 
/usr/work/src/sys/netinet/ip_input.c:1053
#16 0xc013910f in ipintr () at /usr/work/src/sys/netinet/ip_input.c:473
#17 0xc03bfb8f in softint_dispatch (pinned=0xca4e6d20, s=3) at 
/usr/work/src/sys/kern/kern_softint.c:507
#18 0xc0100e4d in Xsoftintr ()
#19 0x00000000 in ?? ()

#10 0xc03de2b2 in seldestroy (sip=0xc14ee270) at 
/usr/work/src/sys/kern/sys_generic.c:1228
1228                    SLIST_REMOVE(&l->l_selwait, sip, selinfo, sel_chain);
(gdb) print *sip
$1 = {sel_klist = {slh_first = 0x0}, sel_lwp = 0xcc3d0d40, sel_chain = 
{sle_next = 0x0}, sel_collision = false}
(gdb) up
#11 0xc03fc595 in sofree (so=0xc14ee1e8) at 
/usr/work/src/sys/kern/uipc_socket.c:626
626             seldestroy(&so->so_rcv.sb_sel);
(gdb) print *so
$2 = {so_type = 1, so_options = 0, so_linger = 0, so_state = 2097, so_nbio = 0, 
so_pcb = 0x0, so_proto = 0xc05cc000,
  so_head = 0x0, so_onq = 0x0, so_q0 = {tqh_first = 0x0, tqh_last = 
0xc14ee204}, so_q = {tqh_first = 0x0,
    tqh_last = 0xc14ee20c}, so_qe = {tqe_next = 0x0, tqe_prev = 0x0}, so_q0len 
= 0, so_qlen = 0, so_qlimit = 0,
  so_timeo = 0, so_error = 0, so_pgid = 0, so_oobmark = 0, so_snd = {sb_sel = 
{sel_klist = {slh_first = 0x0},
      sel_lwp = 0x0, sel_chain = {sle_next = 0x0}, sel_collision = false}, 
sb_mowner = 0x0, sb_cc = 0, sb_hiwat = 0,
    sb_mbcnt = 0, sb_mbmax = 0, sb_lowat = 4096, sb_mb = 0x0, sb_mbtail = 0x0, 
sb_lastrecord = 0x0, sb_flags = 2048,
    sb_timeo = 500, sb_overflowed = 0}, so_rcv = {sb_sel = {sel_klist = 
{slh_first = 0x0}, sel_lwp = 0xcc3d0d40,
      sel_chain = {sle_next = 0x0}, sel_collision = false}, sb_mowner = 0x0, 
sb_cc = 0, sb_hiwat = 0, sb_mbcnt = 0,
    sb_mbmax = 0, sb_lowat = 0, sb_mb = 0x0, sb_mbtail = 0x0, sb_lastrecord = 
0x0, sb_flags = 0, sb_timeo = 0,
    sb_overflowed = 0}, so_internal = 0x0, so_upcall = 0xc0194340 <nb_upcall>, 
so_upcallarg = 0xc1388ca0,
  so_send = 0xc03fc680 <sosend>, so_receive = 0xc03fd650 <soreceive>, so_mowner 
= 0x0, so_uidinfo = 0xca4de400}

>How-To-Repeat:
        
>Fix:
        

>Unformatted: