kern/44788: mlock(2) panic

[Jukka Ruohonen <jruohonen%iki.fi@localhost>]

>Number:         44788
>Category:       kern
>Synopsis:       mlock(2) panic
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Mar 29 11:10:06 +0000 2011
>Originator:     Jukka Ruohonen
>Release:        5.99.48
>Organization:
-
>Environment:

>Description:

While testing the robustness of mlock(2), the following assertion was
easily caught:

panic: kernel diagostic assertion "entry1->start < splitat" failed: file
"/usr/src/sys/uvm/uvm_map.c", line 10660
fatal breakpoint trap in supervisor mode
...
db{1}> bt
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x2b6
kern_assert() at netbsd:kern_assert+0x2d
uvm_mapentt_splitadj() at netbsd:uvm_mapent_splitadj+0xcf
uvm_map_cip_end() at netbsd:uvm_map_clip_end+0x3c
uvm_map_pageable() at netbsd:uvm_map_pageable+0x27f
sys_mlock() at netbsd:sys_mlock+0xa0
syscall() at netbsd:syscall0xaa

>How-To-Repeat:

#include <sys/mman.h>

#include <stdlib.h>
#include <unistd.h>

int
main(void)
{
        void *buf;
        long page;
        size_t i;

        page = sysconf(_SC_PAGESIZE);

        if (page != 4096)
                abort();

        if ((buf = malloc(page)) == NULL)
                abort();

        for (i = page; i >= 1; i = i - 1024) {

                (void)mlock(buf, page - i);
                (void)munlock(buf, page - i);
        }

        return 0;
}

>Fix:

Unknown.

>Unformatted: