kern/42663: lwp_exit() might race with lwp_free()

[rmind%netbsd.org@localhost]

>Number:         42663
>Category:       kern
>Synopsis:       lwp_exit() might race with lwp_free()
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jan 22 20:55:00 +0000 2010
>Originator:     Mindaugas Rasiukevicius
>Release:        NetBSD 5.99.24
>Organization:
>Environment:
>Description:
When used with non-curlwp (e.g. _lwp_create() error path), lwp_exit()
might race with lwp_free().  Specifically, cpu_lwp_free() might be in
action while struct lwp is being re-used post-lwp_free().
>How-To-Repeat:
Code inspection.
>Fix:
a) Set p_zomblwp at the last point.
b) Revisit zombie LWP concept after lwp_cache and uvm_uarea_cache merge.