kern/57316: panic: when closing a timer fd

[kardel%netbsd.org@localhost]

>Number:         57316
>Category:       kern
>Synopsis:       panic: when closing a timer fd
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Apr 01 12:35:01 +0000 2023
>Originator:     kardel%netbsd.org@localhost
>Release:        NetBSD 10.0_BETA
>Organization:
>Environment:
System: NetBSD gaia 10.0_BETA NetBSD 10.0_BETA (GENERIC) #0: Mon Mar 27 11:08:02 CEST 2023 kardel@gaia:/src/NetBSD/n10/src/obj.amd64/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:
	NetBSD 10.0_BETA running as pvh guest on xen panics while bulk building.
	calout_destroy called from itimer_fini() in timerfd_destroy() in timerfd_fop_close().
	Running c_func is claimed to be itimer_callout()

[ 57788.8594117] panic: kernel diagnostic assertion "c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c" failed: file "/src/NetBSD/n10/src/sys/kern/kern_timeout.c", line 381 running callout 0xffff84f27d123d00: c_func (0xffffffff80dea0f5) c_flags (0x100) destroyed from 0xffffffff80e35259
[ 57788.8594117] cpu10: Begin traceback...
[ 57788.8594117] vpanic() at netbsd:vpanic+0x183
[ 57788.8594117] kern_assert() at netbsd:kern_assert+0x4b
[ 57788.8594117] callout_destroy() at netbsd:callout_destroy+0xa2
[ 57788.8594117] timerfd_fop_close() at netbsd:timerfd_fop_close+0x36
[ 57788.8594117] closef() at netbsd:closef+0x60
[ 57788.8594117] fd_close() at netbsd:fd_close+0x138
[ 57788.8594117] sys_close() at netbsd:sys_close+0x22
[ 57788.8594117] syscall() at netbsd:syscall+0x196
[ 57788.8594117] --- syscall (number 6) ---
[ 57788.8594117] netbsd:syscall+0x196:
[ 57788.8594117] cpu10: End traceback...

>How-To-Repeat:
	Run netbsd-GENERIC as phv xen guest and do a bulk build using 40 vcpus.
>Fix:
	check the running callouts are terminated properly.