kern/47012: "shutdown now" from multiuser causes kernel panic (-current)

[rhialto%falu.nl@localhost]

>Number:         47012
>Category:       kern
>Synopsis:       "shutdown now" from multiuser causes kernel panic (-current)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 27 19:05:00 +0000 2012
>Originator:     Rhialto
>Release:        NetBSD current, cvs update finished Sep 25 00:46 CEST
>Organization:
        
>Environment:
        
        
System: NetBSD radl.falu.nl 5.1 NetBSD 6.99.something GENERIC
Architecture: x86_64
Machine: amd64
>Description:
        I used a self-compiled GENERIC amd64 kernel from a "cvs update"
        as of Sep 25 00:46 CEST.
        The userland was from amd64/5.1.
>How-To-Repeat:
        From multi-user, issue the command "shutdown now".
        After most of the procedure has completed, the here is an
        assertion failure followed by a crash dump.
        (I didn't recover the dump).

        The first time it happened I was in X when I issued the shutdown
        command. I could repeat it even when first shutting down X
        (/etc/rc.d/xdm stop), then doing the shutdown from a text console.

        Thu Sep 27 20:44:51 CEST 2012

        Done running shutdown hooks.
        panic: kernel diagnostic assertion "lwpcnt >= 0" failed: file
        "/mnt/vol1/rhialto/cvs/src/sys/kern/kern_uidinfo.c", line 217
        cpu0: Begin traceback...
        kern_assert() at netbsd:kern_assert+0x48
        chglwpcnt() at netbsd:chglwpcnt+0x56
        lwp_free() at netbsd:lwp_free+0x66
        lwp_wait1() at netbsd:lwp_wait1+0x240
        exit_lwps() at netbsd:exit_lwps+0x108
        exit1() at netbsd:exit1+0x6a
        sigexit() at netbsd:sigexit+0x14b
        postsig() at netbsd:postsig+0x15d
        lwp_userret() at netbsd:lwp_userret+0x19b
        syscall() at netbsd:syscall+0x157
        --- syscall (number 0) ---
        7f7ff7934a4a:
        cpu0: End traceback...

        dumping to dev 0,1 (offset=199775, size=1023726):
        dump 3998 3997 3996 3995 3994 3993 3992 3991 3990 3989 ...


        When repeating it just now, it is "cpu1" and the dump freezes at
        3984. That may be a coincidence.

>Fix:
        Unknown so far.

-Olaf.
-- 
___ Olaf 'Rhialto' Seibert  -- There's no point being grown-up if you 
\X/ rhialto/at/xs4all.nl    -- can't be childish sometimes. -The 4th Doctor