kern/83375: Fatal trap 12 cloning a pty

[Marc Olzheim]

>Number:         83375
>Category:       kern
>Synopsis:       Fatal trap 12 cloning a pty
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 13 09:30:13 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Marc Olzheim
>Release:        FreeBSD 5.4-STABLE i386 and 6.0-CURRENT i386
>Organization:
ilse media
>Environment:
System: FreeBSD synth.ilse.net 5.4-STABLE FreeBSD 5.4-STABLE #2: Fri Jul 1 17:08:52 CEST 2005 root at rave.ilse.net:/usr/obj/usr/src/sys/SE3INVAR i386

and

FreeBSD office-install1.ilse.net 6.0-CURRENT FreeBSD 6.0-CURRENT #27: Mon Jul 11 13:03:37 CEST 2005     root at office-install1.ilse.net:/usr/obj/usr/src/sys/CRASH  i386

	Dual Xeon machine, RELENG_5 SMP kernel with INVARIANTS enabled
	to avert this crash for some time.

	and

	Dual Celeron 6.0-CURRENT SMP with practically GENERIC kernel.

	Haven't found a non-SMP machine to test on yet.

>Description:
	Opening a new tty by for instance screen often goes horribly
	wrong. On RELENG_5, it crashes in ptsopen(), on (6-)CURRENT, it
	crashes in the devfs cloning and cleanup routines (each time a
	different location).
>How-To-Repeat:
	Run this:

	crashpts.sh:
-----8<----------8<----------8<----------8<-----
#!/bin/sh

count=0
while true
do
	screen -d -m -c "${PWD}/.screenrc.crashpts" &
	count=$(($count+1))
	if [ $(($count%30)) = 0 ]
	then
		killall screen
		sleep 2
		killall -9 screen
	fi
done
-----8<----------8<----------8<----------8<-----

	screenrc.crashpts:
-----8<----------8<----------8<----------8<-----
screen
screen
screen
screen
screen
screen
screen
screen
screen
screen
-----8<----------8<----------8<----------8<-----
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted: