kern/49862: drm-induced kernel panic

[Thomas Klausner <wiz%NetBSD.org@localhost>]

>Number:         49862
>Category:       kern
>Synopsis:       drm-induced kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Apr 27 09:00:00 +0000 2015
>Originator:     Thomas Klausner
>Release:        NetBSD 7.99.10
>Organization:
Curiosity is the very basis of education and if you tell me that 
curiosity killed the cat, I say only that the cat died nobly.
- Arnold Edinborough
>Environment:
	
	
Architecture: x86_64
Machine: amd64
>Description:

Using 7.99.10/amd64 from Apr 23 with basically a GENERIC kernel, I had
a kernel panic today while opening ~15 files with libreoffice (soffice
*doc).

dmesg contains:
RNING: WSAPRL NNIOTN GL:O WSEPRLE NDO T OLNO WTERRAEPD  EOXNI  T6R A0P
 EXIT 6 0
WARNfI7NfGe:f eWS2P5AL6R 3NNdION:TG
:L OSPWL ENROT ELDOW EROED ONN  TRATPREAXPI TE X6T  06
 0
WARNING: SPL NOT LOWERED ON TRAP EXIT 6 0
WARNING: SPL NOT LOWERED ON TRAP EXIT 6 0
WARNING: SPL NOT LOWERED ON TRAP EXIT 6 0
WARNING: SPL NOT LOWERED ON TRAP EXIT 6 0
cpu3: End traceback...
WARNING: SPL NOT LOWERED ON TRAP EXIT 6 0
WARNING: SPL NOT LOWERED ON TRAP EXIT 6 0
WWAARRNNIINNGG:: S PSPL LNO TN OLTO WLEORWEERDE DO NO NT RTARARAPNP IE NEGXIW:TIATR 6N 6I 0PN0
LG
 :N OSTP LL ONWEORED TON  LOWTERRAP EED IOTN  TRA P0
 EXIT 6 0

dumping to dev 168,3 (offset=8, size=8373576):

/var/run/rc.log says:

[running /etc/rc.d/savecore]
Checking for core dump...
savecore: reboot after panic: panic: kernel diagnostic assertion "((mutex->wwm_state != WW_OWNED) || (mutex->wwm_u.owner != curlwp))" failed: file "/archive/foreign/src/sys/external/bsd/drm2/linux/linux_ww_mutex.c", line 639 locking 0xfffffe86b11fc220 against myself: 0xfffffe881cddd880
savecore: system went down at Sun Apr 26 11:12:50 2015


Backtrace is:
(gdb) target kvm netbsd.78.core
0xffffffff80682ad5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /archive/foreign/src/sys/arch/amd64/amd64/machdep.c:671
671                     dumpsys();
(gdb) bt
#0  0xffffffff80682ad5 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /archive/foreign/src/sys/arch/amd64/amd64/machdep.c:671
#1  0xffffffff808c33e4 in vpanic (fmt=0xffffffff80d8d050 "kernel %sassertion \"%s\" failed: file \"%s\", line %d locking %p against myself: %p", ap=ap@entry=0xfffffe813d79faf8)
    at /archive/foreign/src/sys/kern/subr_prf.c:340
#2  0xffffffff80a61413 in kern_assert (fmt=fmt@entry=0xffffffff80d8d050 "kernel %sassertion \"%s\" failed: file \"%s\", line %d locking %p against myself: %p")
    at /archive/foreign/src/sys/lib/libkern/kern_assert.c:51
#3  0xffffffff8067f0bb in linux_ww_mutex_trylock (mutex=0xfffffe86b11fc220) at /archive/foreign/src/sys/external/bsd/drm2/linux/linux_ww_mutex.c:637
#4  0xffffffff8091dfa4 in __ttm_bo_reserve (ticket=0x0, use_ticket=false, no_wait=true, interruptible=true, bo=0xfffffe86b11fc058)
    at /archive/foreign/src/sys/external/bsd/drm2/dist/include/drm/ttm/ttm_bo_driver.h:852
#5  ttm_bo_reserve (interruptible=true, no_wait=true, ticket=0x0, use_ticket=false, bo=0xfffffe86b11fc058)
    at /archive/foreign/src/sys/external/bsd/drm2/dist/include/drm/ttm/ttm_bo_driver.h:919
#6  ttm_bo_uvm_fault (ufi=ufi@entry=0xfffffe813d79fcc8, vaddr=vaddr@entry=140187597967360, pps=pps@entry=0xfffffe813d79fd80, npages=npages@entry=1, centeridx=centeridx@entry=0,
    access_type=access_type@entry=2, flags=flags@entry=66) at /archive/foreign/src/sys/external/bsd/drm2/ttm/ttm_bo_vm.c:105
#7  0xffffffff807cf0c4 in radeon_ttm_fault (ufi=0xfffffe813d79fcc8, vaddr=140187597967360, pps=0xfffffe813d79fd80, npages=1, centeridx=0, access_type=<optimized out>, flags=66)
    at /archive/foreign/src/sys/external/bsd/drm2/dist/drm/radeon/radeon_ttm.c:873
#8  0xffffffff809b64c1 in uvm_fault_internal (orig_map=orig_map@entry=0xfffffe88260fd460, vaddr=vaddr@entry=140187597967360, access_type=access_type@entry=2,
    fault_flag=fault_flag@entry=0) at /archive/foreign/src/sys/uvm/uvm_fault.c:865
#9  0xffffffff809120f1 in trap (frame=0xfffffe813d79ff00) at /archive/foreign/src/sys/arch/amd64/amd64/trap.c:556
#10 0xffffffff8010108e in alltraps ()

I still have the kernel (+gdb) and the core in case someone
wants to look at them in more detail.
>How-To-Repeat:
Not sure, I have run libreoffice on more files after that and didn't see
it again. Not on that many in a row though.
>Fix:
Please!

>Unformatted: