kern/69066: nmdm page fault when slattach on a null modem device

[Robert Watson]

>Number:         69066
>Category:       kern
>Synopsis:       nmdm page fault when slattach on a null modem device
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 14 21:10:23 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Robert Watson
>Release:        FreeBSD 5-CURRENT i386
>Organization:
-
>Environment:

Using CVS HEAD kernel from around 20040714.  nmdm compiled into the
kernel or loaded in a module.

>Description:

hippy# slattach /dev/nmdm0A
/var/run/slattach.nmdm0A.pid
hippy# 
hippy
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc054e4a5
stack pointer           = 0x10:0xdb0e9cac
frame pointer           = 0x10:0xdb0e9cb4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 47 (swi6:+)
[thread 100026]
Stopped at      nmdm_task_tty+0x11:     movl    0(%eax),%ebx
db> trace
nmdm_task_tty(c26f4c00,2,c22f8958,0,c07d310a) at nmdm_task_tty+0x11
taskqueue_run(c22f8940,db0e9d1c,c05de75c,0,0) at taskqueue_run+0x83
taskqueue_swi_giant_run(0) at taskqueue_swi_giant_run+0xe
ithread_loop(c2308980,db0e9d48,c2308980,c05de628,0) at ithread_loop+0x134
fork_exit(c05de628,c2308980,db0e9d48) at fork_exit+0x98
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xdb0e9d7c, ebp = 0 ---

(kgdb) l *nmdm_task_tty+0x11
0xc054e3e5 is in nmdm_task_tty (../../../dev/nmdm/nmdm.c:153).
148             struct softpart *sp;
149             int c;
150
151             tp = arg;
152             sp = tp->t_sc;
153             otp = sp->other->nm_tty;
154             KASSERT(otp != NULL, ("NULL otp in nmdmstart"));
155             KASSERT(otp != tp, ("NULL otp == tp nmdmstart"));
156             if (sp->other->nm_dcd) {
157                     if (!(tp->t_state & TS_ISOPEN)) {

Looks like sp->other is NULL.

>How-To-Repeat:

slattach on a null modem device seems to repeat this quite easily.  It
sounds a bit like a race in start up or tear-down.

>Fix:

Not included.

>Release-Note:
>Audit-Trail:
>Unformatted: