kern/42309: KASSERT with killing a stopped+traced process

[njoly%pasteur.fr@localhost]

>Number:         42309
>Category:       kern
>Synopsis:       KASSERT with killing a stopped+traced process
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 13 10:40:00 +0000 2009
>Originator:     Nicolas Joly
>Release:        NetBSD 5.99.22
>Organization:
Insitut Pasteur
>Environment:
System: NetBSD lanfeust.sis.pasteur.fr 5.99.22 NetBSD 5.99.22 (LANFEUST) #1: 
Fri Nov 13 11:06:23 CET 2009 
njoly%lanfeust.sis.pasteur.fr@localhost:/local/src/NetBSD/obj.amd64/sys/arch/amd64/compile/LANFEUST
 amd64
Architecture: x86_64
Machine: amd64
>Description:
When trying to kill with SIGKILL a stopped which is traced ...
a DIAGNOSTIC kernel panics:

panic: kernel diagnostic assertion "(ksi->ksi_flags & KSI_QUEUED) == 0" failed:
file "/local/src/NetBSD/src/sys/kern/kern_sig.c", line 584
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff802258d5 cs 8 rflags 246 cr2  575f84 cpl 0 rsp ff
ff80004a59b9e0
Stopped in pid 96.1 (zsh) at    netbsd:breakpoint+0x5:  leave
db{1}> bt
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x2a0
__kernassert() at netbsd:__kernassert+0x2d
sigput() at netbsd:sigput+0x12f
kpsignal2() at netbsd:kpsignal2+0x3a0
sys_kill() at netbsd:sys_kill+0x142
syscall() at netbsd:syscall+0xaa

njoly@lanfeust [netbsd/tmp]> cat ptrace.c 
#include <sys/types.h>
#include <sys/ptrace.h>
#include <err.h>
#include <stdlib.h>
#include <signal.h>

int main() {
  int res;

  warnx("%d", getpid());

  res = ptrace(PT_TRACE_ME, 0, NULL, 0);
  if (res == -1)
    err(1, "ptrace failed");

  raise(SIGSTOP);

  return 0; }
njoly@lanfeust [netbsd/tmp]> make ptrace
cc -O2   -o ptrace ptrace.c 
njoly@lanfeust [netbsd/tmp]> ./ptrace   
ptrace: 753
zsh: suspended (signal)  ./ptrace
njoly@lanfeust [netbsd/tmp]> kill -9 753
[...PANIC...]

>How-To-Repeat:
Issue a SIGKILL to a stopped+traced process.
>Fix:
please.