kern/129846: /usr/sbin/ppp causes panic "Sleeping thread owns a non-sleepable lock

[KOIE Hidetaka]

>Number:         129846
>Category:       kern
>Synopsis:       /usr/sbin/ppp causes panic "Sleeping thread owns a non-sleepable lock
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Dec 22 08:20:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     KOIE Hidetaka
>Release:        current
>Organization:
surigiken
>Environment:
FreeBSD guriandgura 8.0-CURRENT FreeBSD 8.0-CURRENT #0: Sat Dec 20 02:48:43 JST 2008     koie at guriandgura:/usr/obj/usr/src/sys/GURIANDGURA  amd64
>Description:
To connect my PALM (CLIe TH55; http://www.sony.jp/products/Consumer/PEG/PEG-TH55/) using /usr/sbin/ppp(8) via uvisor(4),
the kernel panics with the message:
Sleeping thread (tid 100106, pid 2156) owns a non-sleepable lock

In addition,
ppp reports an error (just before panic):
Add proxy arp entry 10.1.3.63: Invalid argument

[/etc/ppp/ppp.conf]
palm:
  set log Phase Chat LCP IPCP CCP tun command
  ident user-ppp VERSION (built COMPILATIONDATE)
  set speed 115200
  set device /dev/cuaU0
  set dial ""
  set openmode active
  set ifaddr guriandgura.suri.co.jp th55.suri.co.jp
  enable proxy # or bridging?
  accept dns
  disable dns
  set dns 10.1.100.1
  accept lqr
  enable lqr
  set lqrperiod 180
  set timeout 0
  disable vj pred1 deflate ipv6cp
  deny vj pred1 deflate

#guriandgura.suri.co.jp has 10.1.3.67.
#th55.suri.co.jp has 10.1.3.63.


[kgdb]
guriandgura# kgdb kernel.debug /var/crash/vmcore.7
GNU gdb 6.1.1 [FreeBSD]
..
Unread portion of the kernel message buffer:
Sleeping thread (tid 100106, pid 2156) owns a non-sleepable lock
sched_switch() at sched_switch+0xdd
mi_switch() at mi_switch+0x16d
sleepq_catch_signals() at sleepq_catch_signals+0x30f
sleepq_wait_sig() at sleepq_wait_sig+0xc
_cv_wait_sig() at _cv_wait_sig+0x120
seltdwait() at seltdwait+0xf6
kern_select() at kern_select+0x767
select() at select+0x56
syscall() at syscall+0x246
Xfast_syscall() at Xfast_syscall+0xab
--- syscall (93, FreeBSD ELF64, select), rip = 0x80127a32c, rsp = 0x7fffffffe888, rbp = 0x7fffffffeaa0 ---
panic: sleeping thread
cpuid = 1
KDB: enter: panic
Physical memory: 11254 MB
Dumping 612 MB: 597 581 565 549 533 517 501 485 469 453 437 421 405 389 373 357 341 325 309 293 277 261 245 229 213 197 181 165 149 133 117 101 85 69 53 37 21 5

Reading symbols from /boot/kernel/zfs.ko...Reading symbols from /boot/kernel/zfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/zfs.ko
Reading symbols from /boot/kernel/opensolaris.ko...Reading symbols from /boot/kernel/opensolaris.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/opensolaris.ko
#0  doadump () at pcpu.h:196
196             __asm __volatile("movq %%gs:0,%0" : "=r" (td));
(kgdb) bt
#0  doadump () at pcpu.h:196
#1  0xffffffff801b366c in db_fncall (dummy1=Variable "dummy1" is not available.
) at /usr/src/sys/ddb/db_command.c:548
#2  0xffffffff801b39a1 in db_command (last_cmdp=0xffffffff80811a60, cmd_table=Variable "cmd_table" is not available.
)
    at /usr/src/sys/ddb/db_command.c:445
#3  0xffffffff801b3bf0 in db_command_loop () at /usr/src/sys/ddb/db_command.c:498
#4  0xffffffff801b5b89 in db_trap (type=Variable "type" is not available.
) at /usr/src/sys/ddb/db_main.c:229
#5  0xffffffff803743c5 in kdb_trap (type=3, code=0, tf=0xffffffff82edd600)
    at /usr/src/sys/kern/subr_kdb.c:534
#6  0xffffffff805ae461 in trap (frame=0xffffffff82edd600) at /usr/src/sys/amd64/amd64/trap.c:533
#7  0xffffffff805903fe in calltrap () at /usr/src/sys/amd64/amd64/exception.S:217
#8  0xffffffff8037459d in kdb_enter (why=0xffffffff80641d34 "panic", msg=0xa <Address 0xa out of bounds>)
    at cpufunc.h:63
#9  0xffffffff803449ab in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:559
#10 0xffffffff80380844 in propagate_priority (td=Variable "td" is not available.
) at /usr/src/sys/kern/subr_turnstile.c:222
#11 0xffffffff8038156c in turnstile_wait (ts=Variable "ts" is not available.
) at /usr/src/sys/kern/subr_turnstile.c:738
#12 0xffffffff80336500 in _mtx_lock_sleep (m=0xffffff000b72f9a0, tid=18446742974290182144, opts=Variable "opts" is not available.
)
    at /usr/src/sys/kern/kern_mutex.c:408
#13 0xffffffff80403bc3 in rtalloc1_fib (dst=0xffffffff82edd9c8, report=1, ignflags=Variable "ignflags" is not available.
)
    at /usr/src/sys/net/route.c:299
#14 0xffffffff804054df in rtalloc_ign_fib (ro=0xffffffff82edd9c0, ignore=0, fibnum=0)
    at /usr/src/sys/net/route.c:247
#15 0xffffffff804194eb in in_pcbconnect_setup (inp=0xffffff000b803480, nam=Variable "nam" is not available.
)
    at /usr/src/sys/netinet/in_pcb.c:573
#16 0xffffffff8041980f in in_pcbconnect (inp=0xffffff000b803480, nam=Variable "nam" is not available.
) at /usr/src/sys/netinet/in_pcb.c:512
#17 0xffffffff80496a4f in udp_connect (so=0xffffff000ba89280, nam=0xffffff0005730660, td=0xffffff00057fc000)
    at /usr/src/sys/netinet/udp_usrreq.c:1204
#18 0xffffffff803a8642 in kern_connect (td=0xffffff00057fc000, fd=Variable "fd" is not available.
) at /usr/src/sys/kern/uipc_syscalls.c:560
#19 0xffffffff803a87f1 in connect (td=0xffffff00057fc000, uap=0xffffffff82eddc00)
    at /usr/src/sys/kern/uipc_syscalls.c:524
#20 0xffffffff805adde6 in syscall (frame=0xffffffff82eddc90) at /usr/src/sys/amd64/amd64/trap.c:898
#21 0xffffffff8059060b in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:338
#22 0x0000000800d1e8cc in ?? ()
Previous frame inner to this frame (corrupt stack?)
>How-To-Repeat:
1. connect palm
2. run /usr/sbin/ppp as root
3. type "dial palm"
then ppp fails and panic.

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: