kern/54754: assertion "start < end" failed: uvm_map.c, line 4756 uvm_unmap1 start 0 < end 0

[tobiasu%tmux.org@localhost]

>Number:         54754
>Category:       kern
>Synopsis:       assertion "start < end" failed: uvm_map.c, line 4756 uvm_unmap1 start 0 < end 0
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 10 19:50:00 +0000 2019
>Originator:     Tobias Ulmer
>Release:        NetBSD 9.99.21 (GENERIC) #0: Mon Dec 9 04:51:04 UTC 2019
>Organization:
>Environment:
>Description:
Machine hits assertion on login. Full serial console session below, two traces near the end.

screen not found.
Can't open input device.
Keyboard not present.  Using ttya for input and output.

 (2 X UltraSPARC-II 450MHz), No Keyboard
OpenBoot 3.23, 2048 MB memory installed, Serial #13190093.
Ethernet address 8:0:20:c9:43:cd, Host ID: 80c943cd.



Rebooting with command: boot                                          
Boot device: disk  File and args: 
NetBSD IEEE 1275 Multi-FS Bootblock
Version $NetBSD: bootblk.fth,v 1.15 2015/08/20 05:40:08 dholland Exp $
>> NetBSD/sparc64 OpenFirmware Boot, Revision 1.20 (Mon May 14 02:16:29 UTC 2018)
=0xa46798
Loading netbsd: 10774360+499864+326504 [722736+474778]=0xdeea90
[   1.0000000] pool redzone disabled for 'kmem-8192'
[   1.0000000] Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
[   1.0000000]     2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
[   1.0000000]     2018, 2019 The NetBSD Foundation, Inc.  All rights reserved.
[   1.0000000] Copyright (c) 1982, 1986, 1989, 1991, 1993
[   1.0000000]     The Regents of the University of California.  All rights reserved.

[   1.0000000] NetBSD 9.99.21 (GENERIC) #0: Mon Dec  9 04:51:04 UTC 2019
[   1.0000000] 	mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/sparc64/compile/GENERIC
[   1.0000000] total memory = 2048 MB
[   1.0000000] avail memory = 1993 MB
[   1.0000000] pool redzone disabled for 'buf64k'
[   1.0000000] running cgd selftest aes-xts-256 aes-xts-512 done
[   1.0000000] mainbus0 (root): SUNW,Ultra-60 (): hostid 80c943cd
[   1.0000000] cpu0 at mainbus0: SUNW,UltraSPARC-II @ 450.041 MHz, CPU id 0
[   1.0000000] cpu0: manuf 17, impl 11, mask a0
[   1.0000000] cpu0: 16K instruction (32 b/l), 16K data (32 b/l), 4096K external (64 b/l)
[   1.0000000] cpu1 at mainbus0: SUNW,UltraSPARC-II @ 450.041 MHz, CPU id 2
[   1.0000000] cpu1: manuf 17, impl 11, mask a0
[   1.0000000] cpu1: 16K instruction (32 b/l), 16K data (32 b/l), 4096K external (64 b/l)
[   1.0000000] psycho0 at mainbus0 addr 0xfffb4000
[   1.0000000] psycho0: SUNW,psycho: impl 0, version 4: ign 7c0 bus range 0 to 0; PCI bus 0
[   1.0000000] pci0 at psycho0
[   1.0000000] ebus0 at pci0 dev 1 function 0: Sun Microsystems PCIO Ebus2, revision 0x01
[   1.0000000] auxio0 at ebus0 addr 726000-726003, 728000-728003, 72a000-72a003, 72c000-72c003, 72f000-72f003
[   1.0000000] power at ebus0 addr 724000-724003 not configured
[   1.0000000] SUNW,pll at ebus0 addr 504000-504002 not configured
[   1.0000000] sc at ebus0 addr 500000-500007 not configured
[   1.0000000] sab0 at ebus0 addr 400000-40007f ipl 2b: rev 3.2
[   1.0000000] sabtty0 at sab0 port 0: console i/o
[   1.0000000] sabtty1 at sab0 port 1
[   1.0000000] com0 at ebus0 addr 3083f8-3083ff ipl 29: ns16550a, working fifo
[   1.0000000] kbd0 at com0
[   1.0000000] com1 at ebus0 addr 3062f8-3062ff ipl 2a: ns16550a, working fifo
[   1.0000000] ms0 at com1
[   1.0000000] wsmouse0 at ms0 mux 0
[   1.0000000] lpt0 at ebus0 addr 3043bc-3043cb, 300398-300399, 700000-70000f ipl 22
[   1.0000000] fdthree at ebus0 addr 3023f0-3023f7, 706000-70600f, 720000-720003 ipl 27 not configured
[   1.0000000] clock0 at ebus0 addr 0-1fff: mk48t59
[   1.0000000] flashprom at ebus0 addr 0-fffff not configured
[   1.0000000] audiocs0 at ebus0 addr 200000-2000ff, 702000-70200f, 704000-70400f, 722000-722003 ipl 23 ipl 24: CS4231A
[   1.0000000] audio0 at audiocs0: playback, capture, full duplex
[   1.0000000] audio0: slinear_be:16 -> slinear_le:16 2ch 48000Hz, blk 40ms for playback
[   1.0000000] audio0: slinear_be:16 <- slinear_le:16 2ch 48000Hz, blk 40ms for recording
[   1.0000000] spkr0 at audio0: PC Speaker (synthesized)
[   1.0000000] wsbell at spkr0 not configured
[   1.0000000] hme0 at pci0 dev 1 function 1: Sun Happy Meal Ethernet, rev. 1
[   1.0000000] hme0: interrupting at ivec 3021
[   1.0000000] hme0: Ethernet address 08:00:20:c9:43:cd
[   1.0000000] ukphy0 at hme0 phy 1: OUI 0x0006b8, model 0x000c, rev. 1
[   1.0000000] ukphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
[   1.0000000] esiop0 at pci0 dev 3 function 0: Symbios Logic 53c875 (ultra-wide scsi)
[   1.0000000] esiop0: using on-board RAM
[   1.0000000] esiop0: interrupting at ivec 1820
[   1.0000000] scsibus0 at esiop0: 16 targets, 8 luns per target
[   1.0000000] esiop1 at pci0 dev 3 function 1: Symbios Logic 53c875 (ultra-wide scsi)
[   1.0000000] esiop1: using on-board RAM
[   1.0000000] esiop1: interrupting at ivec 1826
[   1.0000000] scsibus1 at esiop1: 16 targets, 8 luns per target
[   1.0000000] ohci0 at pci0 dev 4 function 0: NEC USB Host Controller (rev. 0x43)
[   1.0000000] ohci0: interrupting at ivec 18
[   1.0000000] ohci0: OHCI version 1.0
[   1.0000000] usb0 at ohci0: USB revision 1.0
[   1.0000000] ohci1 at pci0 dev 4 function 1: NEC USB Host Controller (rev. 0x43)
[   1.0000000] ohci1: interrupting at ivec 19
[   1.0000000] ohci1: OHCI version 1.0
[   1.0000000] usb1 at ohci1: USB revision 1.0
[   1.0000000] ehci0 at pci0 dev 4 function 2: NEC USB2 Host Controller (rev. 0x04)
[   1.0000000] ehci0: interrupting at ivec 1a
[   1.0000000] ehci0: 2 companion controllers, 3 ports each: ohci0 ohci1
[   1.0000000] usb2 at ehci0: USB revision 2.0
[   1.0000000] psycho1 at mainbus0 addr 0xfffc6000
[   1.0000000] psycho1: SUNW,psycho: impl 0, version 4: ign 7c0 bus range 128 to 128; PCI bus 128
[   1.0000000] pci1 at psycho1
[   1.0000000] timer0 at mainbus0 addr 0xfff9fc00 irq vectors 7ec
[   1.0000000] pcons at mainbus0 not configured
[   1.0116129] scsibus0: waiting 2 seconds for devices to settle...
[   1.0830559] scsibus1: waiting 2 seconds for devices to settle...
[   1.1549239] wskbd0 at kbd0 mux 1
[   1.2100399] uhub0 at usb0: NetBSD (0000) OHCI root hub (0000), class 9/0, rev 1.00/1.00, addr 1
[   1.3137669] uhub1 at usb1: NetBSD (0000) OHCI root hub (0000), class 9/0, rev 1.00/1.00, addr 1
[   1.4100379] uhub2 at usb2: NetBSD (0000) EHCI root hub (0000), class 9/0, rev 2.00/1.00, addr 1
[   3.2600389] sd0 at scsibus0 target 0 lun 0: <ModusLnk, MXJ3147SC800600W, M108> disk fixed
[   3.3600389] sd0: 136 GB, 78753 cyl, 5 head, 729 sec, 512 bytes/sect x 287277984 sectors
[   3.4600399] sd0: sync (50.00ns offset 16), 16-bit (40.000MB/s) transfers, tagged queueing
[   3.5632849] sd1 at scsibus0 target 1 lun 0: <ModusLnk, MXJ3147SC800600W, M108> disk fixed
[   3.6600379] sd1: 136 GB, 78753 cyl, 5 head, 729 sec, 512 bytes/sect x 287277984 sectors
[   3.7700409] sd1: sync (50.00ns offset 16), 16-bit (40.000MB/s) transfers, tagged queueing
[   4.4600409] cd0 at scsibus0 target 6 lun 0: <TOSHIBA, XM6201TASUN32XCD, 1103> cdrom removable
[   4.5600379] kbd0: reset failed
[   4.7000379] cd0: sync (100.00ns offset 16), 8-bit (10.000MB/s) transfers
[   8.2000409] root on sd0a dumps on sd0b
[   8.2500409] root file system type: ffs
[   8.2900379] kern.module.path=/stand/sparc64/9.99.21/modules
Tue Dec 10 19:18:16 GMT 2019
Starting root file system check:
/dev/rsd0a: file system is clean; not checking
Loading modules.
modload: zfs: No such file or directory
/etc/rc.d/modules exited with code 1
swapctl: setting dump device to /dev/sd0b
swapctl: adding /dev/sd0b as swap device at priority 0
Starting file system checks:
/dev/rsd0d: file system is clean; not checking
/dev/rsd0e: file system is clean; not checking
/dev/rsd0g: file system is clean; not checking
random_seed: /etc/entropy-file: Not present
Setting tty flags.
ttyflags: open /dev/ttyC00: Device busy
ttyflags: open /dev/ttyC01: Device busy
Setting sysctl variables:
ddb.onpanic: 1 -> 0
kern.maxfiles: 3404 -> 20000
Starting network.
Hostname: u60.tmux.org
IPv6 mode: host
Configuring network interfaces:.
Adding interface aliases:.
Waiting for DAD to complete for statically configured addresses...
Starting dhcpcd.
DUID 00:01:00:01:22:8c:30:9a:08:00:20:c9:43:cd
hme0: IAID 20:c9:43:cd
hme0: carrier lost
hme0: carrier acquired
hme0: IAID 20:c9:43:cd
hme0: carrier lost
hme0: carrier acquired
hme0: IAID 20:c9:43:cd
hme0: rebinding lease of 192.168.2.52
hme0: leased 192.168.2.52 for 86400 seconds
hme0: adding route to 192.168.2.0/24
hme0: adding default route via 192.168.2.1
forked to background, child pid 229
Building databases: dev, utmp, utmpx.
Starting syslogd.
Mounting all file systems...
Clearing temporary files.
Updating fontconfig cache: done.
Checking quotas: done.
Setting securelevel: kern.securelevel: 0 -> 1
swapctl: setting dump device to /dev/sd0b
Starting virecover.
Checking for core dump...
savecore: warning: /dev/ksyms version mismatch:
        NetBSD 9.99.21 (GENERIC) #0: Mon Dec  9 04:51:04 UTC 2019
        mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/sparc64/compile/GENERIC

and     an

Dec 10 19:18:33 u60 savecore: reboot
savecore: reboot
savecore: system went down at Wed Feb  2 10:08:00 2107

savecore: dump time is unreasonable
/etc/rc.d/savecore exited with code 1
Starting local daemons:.
Updating motd.
Starting ntpd.
Starting sshd.
Starting postfix.
Starting inetd.
Starting cron.
The following components reported failures:
    /etc/rc.d/modules /etc/rc.d/savecore
See /var/run/rc.log for more information.
Tue Dec 10 19:18:45 UTC 2019

NetBSD/sparc64 (u60.tmux.org) (console)

login: root
Password:
Dec 10 19:19:13 u60 login: ROOT LOGIN (root) on tty console
Last login: Tue Dec 10 18:13:07 2019 from 192.168.2.40 on pts/0
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
    2018, 2019 The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 9.99.21 (GENERIC) #0: Mon Dec 9 04:51:04 UTC 2019

Welcome to NetBSD!

This system is running a development snapshot of the NetBSD operating system,
also known as NetBSD-current.  It is very possible that it has serious bugs,
regressions, broken features or other problems.  Please bear this in mind
and use the system with care.

You are encouraged to test this version as thoroughly as possible.  Should you
encounter any problem, please report it back to the development team using the
send-pr(1) utility (requires a working MTA).  If yours is not properly set[  67.1322290] panic: kernel diagnostic assertion "start < end" failed: file "/home/source/ab/HEAD/src/sys/uvm/uvm_map.c", line 4756 uvm_unmap1: map 0x102784320: start 0 < end 0
[  67.3222387] cpu1: Begin traceback...
[  67.3622410] cpu1: End traceback...
[  67.4022423] Frame pointer is at 0x177bcac81
[  67.4522461] Call traceback:
 up[  67.4922473]  netbsd:cpu_reboot+0x24c(19905d0, 1, ffff, 195f7f1, 15dd340, 1c6fc00) fp = 177bcad61
,[  67.5922540]  netbsd:vpanic+0x158(104, 0, 1cbc400, 0, 0, 10295ae00) fp = 177bcae11
[  67.6822581]  netbsd:kern_assert+0x34(19ad280, 177bcb808, 1cc0400, 1cc1800, 104, 1cc1770) fp = 177bcaec1

[  67.8022649]  netbsd:uvm_unmap1+0x88(19ad280, 1923878, 19ac070, 19ac638, 1294, 1908308) fp = 177bcaf81
us[  67.9122711]  netbsd:execve_runproc+0x220(102784320, 0, 0, 0, 0, 101fa6f40) fp = 177bcb061
e[  68.0122787]  netbsd:execve1+0x58(10295ae00, 177bcba10, 0, 0, 102784320, 102958980) fp = 177bcb151
 [  68.1222829]  netbsd:sys_execve+0x24(10295ae00, 1, 40228090, ffffffffffffffff, ffffffffffffd0f0, 402f4400) fp = 177bcb431
t[  68.2522913]  netbsd:syscall+0x41c(10295ae00, 177bcbde0, 177bcbdd0, 1, 40b063f0, 6cebac5) fp = 177bcb4f1
[  68.3622965]  netbsd:1011724+0(177bcbed0, 177bcbf58, 40b60480, 3, 2, 10295ae00) fp = 177bcb621
[  68.4623021]  netbsd:40c74fe8+0(40228090, ffffffffffffd0f0, 402f4400, fefefefefefefeff, ffffffffffffffff, ff000000000000) fp = ffffffffffffc381

[  68.6223112] dumping to dev 7,1 offset 4196485
  2047 M etBSD.org/support/send-pr.htmlw.N
  2046 M 
  2045 M d improve NetBSD.ping us test an


  2044 M e new mail.
           
[ 159.3774377] dump succeeded
[ 159.4074384] cpu0: shutting down
[ 159.4074384] cpu1: rebooting

Resetting ...


============================================

NetBSD/sparc64 (u60.tmux.org) (console)

login: root
Password:
Dec 10 18:57:49 u60 login: ROOT LOGIN (root) on tty console
Last login: Tue Dec 10 18:13:07 2019 from 192.168.2.40 on pts/0
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016, 2017,
    2018, 2019 The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 9.99.12 (GENERIC) #0: Sun Sep 22 10:35:12 UTC 2019

Welcome to NetBSD!

This system is running a development snapshot of the NetBSD operating system,
also known as NetBSD-current.  It is very possible that it has serious bugs,
regressions, broken features or other problems.  Please bear this in mind
and use the system with care.

You are encouraged to test this version as thoroughly as possible.  Should you
encounter any problem, please report it back to the development team using the
send-pr(1) utility (requires a working MTA).  If yours is not properly set [  52.0614343] panic: kernel diagnostic assertion "start < end" failed: file "/usr/src/sys/uvm/uvm_map.c", line 4735 uvm_unmap1: map 0x1027e4bc0: start 0 < end 0
[  52.2314419] cpu1: Begin traceback...
[  52.2714432] cpu1: End traceback...
[  52.3114464] Frame pointer is at 0x178e5cc81
[  52.3614493] Call traceback:
up,[  52.4014505]  netbsd:cpu_reboot+0x244(198c9b0, 1, ffff, 195cc01, 15d9b60, 1c6f800) fp = 178e5cd61
[  52.5014572]  netbsd:vpanic+0x174(104, 0, 19a8b38, 1cb7400, 0, 102c709c0) fp = 178e5ce11

[  52.6014628]  netbsd:kern_assert+0x34(19a8b38, 178e5d808, 1cbf400, 1cc0800, 104, 1cc0968) fp = 178e5cec1
u[  52.7114690]  netbsd:uvm_unmap1+0x88(19a8b38, 1920f50, 19a7948, 19a7f00, 127f, 1905f00) fp = 178e5cf81
se[  52.8314758]  netbsd:execve_runproc+0x228(1027e4bc0, 0, 0, 0, 0, 101e90f40) fp = 178e5d061
 [  52.9314815]  netbsd:execve1+0x58(102c709c0, 178e5da10, 0, 0, 3, 103707c68) fp = 178e5d151
t[  53.0214875]  netbsd:sys_execve+0x24(102c709c0, 1, 40228090, ffffffffffffffff, ffffffffffffd0f0, 402f4400) fp = 178e5d431
h[  53.1614944]  netbsd:syscall+0x384(102c709c0, 178e5dde0, 178e5ddd0, 1, 40b063f0, 6cebac5) fp = 178e5d4f1
[  53.2715007]  netbsd:1011724+0(178e5ded0, c3b, 40b60480, 3b, 178e5df40, 102c709c0) fp = 178e5d621
[  53.3715063]  netbsd:40c74fe8+0(40228090, ffffffffffffd0f0, 402f4400, fefefefefefefeff, ffffffffffffffff, ff000000000000) fp = ffffffffffffc381

[  53.5315153] dumping to dev 7,1 offset 4196485
  2047 M tBSD.org/support/send-pr.htmlw.Ne

  2045 M  improve NetBSD.lping us test and

  2044 M w mail.
           
[ 144.2666407] dump succeeded
[ 144.2966434] cpu0: shutting down
[ 144.2966434] cpu1: rebooting


^^ This trace from 9.99.12!!
>How-To-Repeat:
Log in, either via serial or ssh, watch the machine crash and burn.

9.99.12 has the same issue, so this has been around for a while, however I could log in via ssh today and do the update, so it wasn't quite as severe.
>Fix: