kern/58003: crash when freeing vnodes

[martin%NetBSD.org@localhost]

>Number:         58003
>Category:       kern
>Synopsis:       crash when freeing vnodes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 06 17:25:00 +0000 2024
>Originator:     Martin Husemann
>Release:        NetBSD 10.99.10
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD out-of-the-silent-planet.aprisoft.de 10.99.10 NetBSD 10.99.10 (GENERIC64) #426: Wed Mar 6 14:20:02 CET 2024 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/evbarm/compile/GENERIC64 evbarm
Architecture: aarch64
Machine: evbarm
>Description:

While running a full ATF test on this machine using a evbearmv7hf-el
userland via compat_netbsd32, in the fs/tmpfs/t_vnode_leak test:

[ 6882.4693254] panic: pr_phinpage_check: [kmem-00256] item 0xffff00007e0d2e00 not part of pool
[ 6882.4693254] cpu0: Begin traceback...
[ 6882.4828323] trace fp ffffc000f01b7880
[ 6882.4828323] fp ffffc000f01b78b0 vpanic() at ffffc000005aba78 netbsd:vpanic+0x178
[ 6882.4922771] fp ffffc000f01b7910 panic() at ffffc000005abb84 netbsd:panic+0x44
[ 6882.5022738] fp ffffc000f01b79a0 pool_cache_put_paddr() at ffffc000005a8cd0 netbsd:pool_cache_put_paddr+0x180
[ 6882.5022738] fp ffffc000f01b79f0 mutex_obj_free() at ffffc000005583dc netbsd:mutex_obj_free+0x58
[ 6882.5177272] fp ffffc000f01b7a10 vcache_free() at ffffc00000617f50 netbsd:vcache_free+0x80
[ 6882.5262984] fp ffffc000f01b7a40 vrelel() at ffffc000006190d4 netbsd:vrelel+0x694
[ 6882.5362977] fp ffffc000f01b7ad0 vrecycle() at ffffc0000061a294 netbsd:vrecycle+0x74
[ 6882.5362977] fp ffffc000f01b7b10 vdrain_one() at ffffc0000061aa78 netbsd:vdrain_one+0x1c8
[ 6882.5498253] fp ffffc000f01b7b90 vfs_drainvnodes() at ffffc0000061c308 netbsd:vfs_drainvnodes+0x24
[ 6882.5584834] fp ffffc000f01b7c20 sysctl_kern_maxvnodes() at ffffc0000052b980 netbsd:sysctl_kern_maxvnodes+0xc0
[ 6882.5684809] fp ffffc000f01b7cd0 sysctl_dispatch() at ffffc00000578174 netbsd:sysctl_dispatch+0xb4
[ 6882.5794738] fp ffffc000f01b7d40 netbsd32___sysctl() at ffffc000002802a4 netbsd:netbsd32___sysctl+0xd4
[ 6882.5888318] fp ffffc000f01b7de0 netbsd32_syscall() at ffffc000000bf36c netbsd:netbsd32_syscall+-0x1b5cb4
[ 6882.5988906] tf ffffc000f01b7ed0 el0_trap() at ffffc000000b67f0 netbsd:el1_trap_exit+0x68
[ 6882.5988906] ---- switchframe 0xffffc000f01b7ed0 (304 bytes) ----
[ 6882.6134090]    x19=0000000000000000,    x20=0000000000000000
[ 6882.6191773]    x21=0000000000000000,    x22=0000000000000000
[ 6882.6191773]    x23=0000000000000000,    x24=0000000000000000
[ 6882.6307216]    x25=0000000000000000,    x26=0000000000000000
[ 6882.6307216]    x27=0000000000000000,    x28=0000000000000000
[ 6882.6422674] fp=x29=0000000000000000, lr=x30=0000000000000000
[ 6882.6422674] ------------------------------------------------
[ 6882.6538115] cpu0: End traceback...
Stopped in pid 5192.5192 (sysctl) at    netbsd:cpu_Debugger+0xc:        ldp     
x29, x30, [sp],#16


>How-To-Repeat:
See above (not sure it is repeatable, will update the PR if it is)

>Fix:
n/a