kern/42611: uvm_km_va_drain() may have locking problems

[tnn%NetBSD.org@localhost]

>Number:         42611
>Category:       kern
>Synopsis:       uvm_km_va_drain() may have locking problems
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jan 12 11:05:00 +0000 2010
>Originator:     Tobias Nygren
>Release:        5.99.22
>Organization:
>Environment:
>Description:
This was originally reported in kern/39283 but is really a
separate issue. uvm_km_va_drain() may cause recursive entry
on pool_cache locks if a network interrupt occurs.

kern/39283 backtrace:
 panic: lock error
 cpu_Debugger() at netbsd:cpu_Debugger+0x9
 panic() at netbsd:panic+0x1f6
 lockdebug_abort() at netbsd:lockdebug_abort+0x8f
 mutex_abort() at netbsd:mutex_abort+0x29
 mutex_vector_enter() at netbsd:mutex_vector_enter+0x1c4
 pool_cache_invalidate() at netbsd:pool_cache_invalidate+0x23
 pool_reclaim() at netbsd:pool_reclaim+0x69
 pool_reclaim_callback() at netbsd:pool_reclaim_callback+0x41
 callback_run_roundrobin() at netbsd:callback_run_roundrobin+0x100
 uvm_km_va_drain() at netbsd:uvm_km_va_drain+0x1a
 uvm_map_prepare() at netbsd:uvm_map_prepare+0x1ed
 uvm_map() at netbsd:uvm_map+0x127
 km_vacache_alloc() at netbsd:km_vacache_alloc+0x53
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 uvm_km_alloc_poolpage_cache() at netbsd:uvm_km_alloc_poolpage_cache+0x4a
 pool_page_alloc() at netbsd:pool_page_alloc+0x13
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 pool_cache_get_slow() at netbsd:pool_cache_get_slow+0x1b6
 pool_cache_get_paddr() at netbsd:pool_cache_get_paddr+0x14d
 m_get() at netbsd:m_get+0x26
 m_gethdr() at netbsd:m_gethdr+0x9
 bnx_get_buf() at netbsd:bnx_get_buf+0x75
 bnx_rx_intr() at netbsd:bnx_rx_intr+0x2ac
 bnx_intr() at netbsd:bnx_intr+0xf1
 intr_biglock_wrapper() at netbsd:intr_biglock_wrapper+0x1d
 Xintr_ioapic_level1() at netbsd:Xintr_ioapic_level1+0xf4
 --- interrupt ---
 mutex_enter() at netbsd:mutex_enter+0x11
 pool_reclaim() at netbsd:pool_reclaim+0x69
 pool_reclaim_callback() at netbsd:pool_reclaim_callback+0x41
 callback_run_roundrobin() at netbsd:callback_run_roundrobin+0x100
 uvm_km_va_drain() at netbsd:uvm_km_va_drain+0x1a
 uvm_map_prepare() at netbsd:uvm_map_prepare+0x1ed
 uvm_map() at netbsd:uvm_map+0x127
 km_vacache_alloc() at netbsd:km_vacache_alloc+0x53
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 uvm_km_alloc_poolpage_cache() at netbsd:uvm_km_alloc_poolpage_cache+0x4a
 pool_page_alloc() at netbsd:pool_page_alloc+0x13
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 pool_cache_get_slow() at netbsd:pool_cache_get_slow+0x1b6
 pool_cache_get_paddr() at netbsd:pool_cache_get_paddr+0x14d
 bt_alloc() at netbsd:bt_alloc+0x1d
 vmem_add1() at netbsd:vmem_add1+0xa3
 vmem_xalloc() at netbsd:vmem_xalloc+0x58b
 vmem_alloc() at netbsd:vmem_alloc+0x14d
 qc_poolpage_alloc() at netbsd:qc_poolpage_alloc+0x61
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 pool_cache_get_slow() at netbsd:pool_cache_get_slow+0x1b6
 pool_cache_get_paddr() at netbsd:pool_cache_get_paddr+0x14d
 vmem_alloc() at netbsd:vmem_alloc+0x11e
 kmem_alloc() at netbsd:kmem_alloc+0x198
 amap_copy() at netbsd:amap_copy+0x214
 uvm_fault_internal() at netbsd:uvm_fault_internal+0x30c
 trap() at netbsd:trap+0x7da
 --- trap (number 4233368) ---
 0x152de:
 db{0}> mach cpu 1
 using CPU 1
 db{0}> bt
 x86_pause() at netbsd:x86_pause
 mutex_vector_enter() at netbsd:mutex_vector_enter+0x207
 pool_cache_invalidate() at netbsd:pool_cache_invalidate+0x23
 pool_reclaim() at netbsd:pool_reclaim+0x69
 pool_reclaim_callback() at netbsd:pool_reclaim_callback+0x41
 callback_run_roundrobin() at netbsd:callback_run_roundrobin+0x100
 uvm_km_va_drain() at netbsd:uvm_km_va_drain+0x1a
 uvm_map_prepare() at netbsd:uvm_map_prepare+0x1ed
 uvm_map() at netbsd:uvm_map+0x127
 km_vacache_alloc() at netbsd:km_vacache_alloc+0x53
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 uvm_km_alloc_poolpage_cache() at netbsd:uvm_km_alloc_poolpage_cache+0x4a
 pool_page_alloc() at netbsd:pool_page_alloc+0x13
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 pool_cache_get_slow() at netbsd:pool_cache_get_slow+0x1b6
 pool_cache_get_paddr() at netbsd:pool_cache_get_paddr+0x14d
 bt_alloc() at netbsd:bt_alloc+0x1d
 vmem_xalloc() at netbsd:vmem_xalloc+0x2f5
 vmem_alloc() at netbsd:vmem_alloc+0x14d
 qc_poolpage_alloc() at netbsd:qc_poolpage_alloc+0x61
 pool_grow() at netbsd:pool_grow+0x36
 pool_get() at netbsd:pool_get+0x1ca
 pool_cache_get_slow() at netbsd:pool_cache_get_slow+0x1b6
 pool_cache_get_paddr() at netbsd:pool_cache_get_paddr+0x14d
 vmem_alloc() at netbsd:vmem_alloc+0x11e
 kmem_alloc() at netbsd:kmem_alloc+0x198
 amap_copy() at netbsd:amap_copy+0x214
 uvm_fault_internal() at netbsd:uvm_fault_internal+0x30c
 trap() at netbsd:trap+0x7da
 --- trap (number 4233368) ---
 0x152de:
 db{0}>

>How-To-Repeat:
starve the kernel on kva by introducing memory leaks

>Fix: