mtx_unlock(NULL) in kern/kern_timeout.c::softclock()

[Eygene Ryabinkin]

Good day.

About two weeks ago I started to notice ;)) the kernel panics on
my -CURRENT just after the PPP link establishment. The panics were
in the softclock() function, upon the line 293.

Investigation revealed that I can reproduce this situation with the
100% confidence when the ULE scheduler is used, the pflog(4) is
running in the promiscious mode and the PPP link is activated using
the ppp(8). I have both INVARIANTS and WITNESS compiled in, this
neither affects the crash, nor produces additional messages.  For
the BSD scheduler all is OK, no crashes at all.

The attached patch had fixed my problem: it just checks if we're
going to unlock the NULL mutex and avoids this. I am not very well
educated in the FreeBSD mutexes, but my investigation of the
/sys/sys/mutex.h showed that mtx_unlock(NULL) is not a very bright
idea. Moreover, the softclock() code grabs the c_mtx only when
(c_mtx != NULL), so it should release it only in this case.

May be my case is the sign of some deeper breakage, I do not know.
I had failed to save the kgdb() traces for panics and had recompiled
the kernel since then a number of times, so I am unable to provide
the backtraces now. But I can revert my changes and make the traces
if this will be needed.
-- 
Eygene
-------------- next part --------------
--- kern/kern_timeout.c.orig	Sat Apr 21 21:19:22 2007
+++ kern/kern_timeout.c	Sat Apr 21 21:19:51 2007
@@ -289,7 +289,8 @@
 					lastfunc = c_func;
 				}
 #endif
-				if ((c_flags & CALLOUT_RETURNUNLOCKED) == 0)
+				if (c_mtx != NULL &&
+				    (c_flags & CALLOUT_RETURNUNLOCKED) == 0)
 					mtx_unlock(c_mtx);
 			skip:
 				mtx_lock_spin(&callout_lock);