kern/49098: unaligned access adding rnd data

[martin%NetBSD.org@localhost]

>Number:         49098
>Category:       kern
>Synopsis:       unaligned access adding rnd data
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 11 09:50:00 +0000 2014
>Originator:     Martin Husemann
>Release:        NetBSD 6.99.49
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD gemini.duskware.de 6.99.49 NetBSD 6.99.49 (GENERIC-$Revision: 
1.358 $) #3: Sat Aug 2 12:14:22 CEST 2014 
martin%night-owl.duskware.de@localhost:/usr/obj/alpha/usr/src/sys/arch/alpha/compile/GENERIC
 alpha
Architecture: alpha
Machine: alpha
>Description:

Booting a kernel as of today crashes this machine with:

Setting date via ntp.
CPU 0: fatal kernel trap:

CPU 0    trap entry = 0x4 (unaligned access fault)
CPU 0    a0         = 0xfffffc003ebfba6a
CPU 0    a1         = 0x28
CPU 0    a2         = 0x16
CPU 0    pc         = 0xfffffc00007a572c
CPU 0    ra         = 0xfffffc00007a7160
CPU 0    pv         = 0xfffffc00007a56f0
CPU 0    curlwp     = 0xfffffc003fe3f980
CPU 0        pid = 0, comm = system

panic: trap
cpu0: Begin traceback...
alpha trace requires known PC =eject=

(gdb) list *0xfffffc00007a572c
0xfffffc00007a572c is in rndpool_add_data (../../../../kern/kern_rndpool.c:214).
209             u_int32_t val;
210             const u_int8_t * buf;
211     
212             buf = p;
213     
214             for (; len > 3; len -= 4) {
215                     val = *((const u_int32_t *)buf);
216     
217                     rndpool_add_one_word(rp, val);
218                     buf += 4;

apparently called from:
0xfffffc00007a7160 is in rnd_add_data (../../../../kern/kern_rndq.c:807).
802              * itself, random.  Don't estimate entropy based on
803              * timestamp, just directly add the data.
804              */
805             if (__predict_false(rs == NULL)) {
806                     mutex_spin_enter(&rndpool_mtx);
807                     rndpool_add_data(&rnd_pool, data, len, entropy);
808                     mutex_spin_exit(&rndpool_mtx);
809             } else {
810                     rnd_add_data_ts(rs, data, len, entropy, rnd_counter());
811             }


>How-To-Repeat:
not sure - 100% reproducable on this machine

>Fix:
n/a