Re: kern/51056: reader-writer lock error

[Martin Husemann <martin%duskware.de@localhost>]

The following reply was made to PR kern/51056; it has been noted by GNATS.

From: Martin Husemann <martin%duskware.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/51056: reader-writer lock error
Date: Sat, 9 Apr 2016 22:08:07 +0200

 On Sat, Apr 09, 2016 at 04:17:51PM +0200, Martin Husemann wrote:
 > I had the same crash again with a very recentish kernel, now running the
 > same with LOCKDEBUG.
 
 And it says (if I deciphered the photo correctly) the lock in question
 was locked here:
 
 nd6_llinfo_timer(void *arg)
 {
         struct llentry *ln = arg;
         struct ifnet *ifp;
         struct nd_ifinfo *ndi = NULL;
         bool send_ns = false;
         const struct in6_addr *daddr6 = NULL;
         
         mutex_enter(softnet_lock);
         KERNEL_LOCK(1, NULL);
 
         LLE_WLOCK(ln);
 
 
 i.e.:
 #13 0xffffffff8050595d in nd6_llinfo_timer (arg=0xfffffe8135c863c8)
     at ../../../../netinet6/nd6.c:490
 
 where
 
 (gdb) p arg
 $3 = (void *) 0xfffffe8135c863c8
 
 (gdb) p *(struct llentry *)arg
 $4 = {lle_next = {le_next = 0x0, le_prev = 0xfffffe810744fa10}, r_l3addr = {
     addr4 = {s_addr = 33587454}, addr6 = {__u6_addr = {
         __u6_addr8 = "\376\000\002\000\000\000\000\236Ç\246\377\376\233\267r", __u6_addr16 = {33022, 512, 0, 0, 51102, 65446, 39934, 29367}, __u6_addr32 = {
           33587454, 0, 4289120158, 1924635646}}}}, ll_addr = {
     mac_aligned = 126132915980188, mac16 = {51100, 39846, 29367}, 
     mac8 = "\234Ç\246\233\267r", '\000' <repeats 13 times>}, spare0 = 0, 
   spare1 = 0, lle_tbl = 0xfffffe81071997d0, lle_head = 0xfffffe810744fa10, 
   lle_free = 0xffffffff804ee628 <in6_lltable_destroy_lle>, lle_ll_free = 0x0, 
   la_hold = 0x0, la_numheld = 0, la_expire = 0, la_flags = 8264, la_asked = 3, 
   la_preempt = 0, ln_byhint = 0, ln_state = 0, ln_router = 1, ln_ntick = 0, 
   lle_refcnt = 412, lle_chain = {le_next = 0x0, le_prev = 0x0}, lle_timer = {
     _c_store = {0xffffffff815025e8 <callout_cpu0+168>, 
       0xffffffff815025e8 <callout_cpu0+168>, 
       0xffffffff8050557c <nd6_llinfo_timer>, 0xfffffe8135c863c8, 
       0xffffffff81502540 <callout_cpu0>, 0x108000e39cf, 0x11deeba1, 0x0, 0x0, 
       0x0}}, lle_lock = {rw_owner = 18446742429671606372}, la_opaque = 0x0}
 
 
 and then in 
 
 #6  0xffffffff804eed4d in in6_lltable_lookup (llt=<optimized out>, 
     flags=<optimized out>, l3addr=<optimized out>)
     at ../../../../netinet6/in6.c:2487
 
         if (flags & LLE_EXCLUSIVE)
                 LLE_WLOCK(lle);
         else
                 LLE_RLOCK(lle);
         return lle;
 }
 
 we try to lock it again.
 
 (gdb) p lle
 $5 = (struct llentry *) 0xfffffe8135c863c8
 (gdb) p *lle
 $6 = {lle_next = {le_next = 0x0, le_prev = 0xfffffe810744fa10}, r_l3addr = {
     addr4 = {s_addr = 33587454}, addr6 = {__u6_addr = {
         __u6_addr8 = "\376\000\002\000\000\000\000\236Ç\246\377\376\233\267r", __u6_addr16 = {33022, 512, 0, 0, 51102, 65446, 39934, 29367}, __u6_addr32 = {
           33587454, 0, 4289120158, 1924635646}}}}, ll_addr = {
     mac_aligned = 126132915980188, mac16 = {51100, 39846, 29367}, 
     mac8 = "\234Ç\246\233\267r", '\000' <repeats 13 times>}, spare0 = 0, 
   spare1 = 0, lle_tbl = 0xfffffe81071997d0, lle_head = 0xfffffe810744fa10, 
   lle_free = 0xffffffff804ee628 <in6_lltable_destroy_lle>, lle_ll_free = 0x0, 
   la_hold = 0x0, la_numheld = 0, la_expire = 0, la_flags = 8264, la_asked = 3, 
   la_preempt = 0, ln_byhint = 0, ln_state = 0, ln_router = 1, ln_ntick = 0, 
   lle_refcnt = 412, lle_chain = {le_next = 0x0, le_prev = 0x0}, lle_timer = {
     _c_store = {0xffffffff815025e8 <callout_cpu0+168>, 
       0xffffffff815025e8 <callout_cpu0+168>, 
       0xffffffff8050557c <nd6_llinfo_timer>, 0xfffffe8135c863c8, 
       0xffffffff81502540 <callout_cpu0>, 0x108000e39cf, 0x11deeba1, 0x0, 0x0, 
       0x0}}, lle_lock = {rw_owner = 18446742429671606372}, la_opaque = 0x0}