kern/48386: Kernel panic on shutdown

[aran%100acres.us@localhost]

>Number:         48386
>Category:       kern
>Synopsis:       Kernel panic on shutdown
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 17 19:35:00 +0000 2013
>Originator:     Aran Clauson
>Release:        6.99.27
>Organization:
>Environment:
NetBSD sanders 6.99.27 NetBSD 6.99.27 (GENERIC) #0: Sun Nov 17 00:08:39 PST 
2013  aran@sanders:/home/NetBSD/obj/sys/arch/amd64/compile/GENERIC amd64
>Description:
When shutting down I sometimes get a kernel panic.  Now that I have a kernel 
with debugging turned on, I've been able to case down the error.  The panic is 
at src/sys/kern/kern_uidinfo.c:217:

209     int
210     chglwpcnt(uid_t uid, int diff)
211     {
212             struct uidinfo *uip;
213             long lwpcnt;
214
215             uip = uid_find(uid);
216             lwpcnt = atomic_add_long_nv(&uip->ui_lwpcnt, diff);
217             KASSERT(lwpcnt >= 0);
218             return lwpcnt;
219     }

This is called from lwp_free when shutting down dhclient.  It appears that 
dhclient has two remaining threads, but the user info structure says that 
ui_lwpcnt==0 for UDI=0.  The atomic_add_long_nv decrements the count to -1 and 
the assert fails.


>How-To-Repeat:

>Fix: