latest openjdk7 triggers kernel panic

[Andriy Gapon]

I am running FreeBSD based on the head from a few weeks ago, amd64.

It seems that after a recent upgrade of openjdk7 I consistently get a kernel
panic when a java process starts:

panic: Bad entry start/end for new stack entry
KDB: stack backtrace:
db_trace_self_wrapper() at 0xffffffff803adc9b = db_trace_self_wrapper+0x2b/frame
0xfffffe02ba6fe6e0
kdb_backtrace() at 0xffffffff805cbd79 = kdb_backtrace+0x39/frame 0xfffffe02ba6fe790
panic() at 0xffffffff80597733 = panic+0x1a3/frame 0xfffffe02ba6fe810
vm_map_stack() at 0xffffffff80719f2e = vm_map_stack+0x3ce/frame 0xfffffe02ba6fe8a0
vm_mmap() at 0xffffffff8071c270 = vm_mmap+0x520/frame 0xfffffe02ba6fea30
sys_mmap() at 0xffffffff8071bad3 = sys_mmap+0x303/frame 0xfffffe02ba6feaf0
amd64_syscall() at 0xffffffff8074d0c8 = amd64_syscall+0x238/frame 0xfffffe02ba6febf0
Xfast_syscall() at 0xffffffff80733e2b = Xfast_syscall+0xfb/frame 0xfffffe02ba6febf0

Specifically, new_entry->end != top condition is true.
new_entry->end is consistently greater than top by 3 pages.

I suspect that java now does some hacky things with its stack and I suspect that
vm_map_simplify_entry() call at the end of vm_map_insert() could be to blame.
Although, the call is guarded by a check:

1290         /*
1291          * It may be possible to merge the new entry with the next and/or
1292          * previous entries.  However, due to MAP_STACK_* being a hack, a
1293          * panic can result from merging such entries.
1294          */
1295         if ((cow & (MAP_STACK_GROWS_DOWN | MAP_STACK_GROWS_UP)) == 0)
1296                 vm_map_simplify_entry(map, new_entry);

But that check seems to be defeated by the fact that vm_map_stack() clears our
the relevant bits after saving them locally:

3335         /*
3336          * The stack orientation is piggybacked with the cow argument.
3337          * Extract it into orient and mask the cow argument so that we
3338          * don't pass it around further.
3339          * NOTE: We explicitly allow bi-directional stacks.
3340          */
3341         orient = cow & (MAP_STACK_GROWS_DOWN|MAP_STACK_GROWS_UP);
3342         cow &= ~orient;

-- 
Andriy Gapon