lock order reversal

[Duane Whitty]

>Submitter-Id:	current-users
>Originator:	Duane Whitty
>Organization:	
>Confidential:	no 
>Synopsis:	lock order reversal
>Severity:	serious
>Priority:	medium
>Category:	kern
>Class:		sw-bug
>Release:	FreeBSD 6.2-PRERELEASE i386
>Environment:
System: FreeBSD dwpc.dwlabs.ca 6.2-PRERELEASE FreeBSD 6.2-PRERELEASE #1: Tue Sep 12 00:24:56 ADT 2006 duane at dwpc.dwlabs.ca:/usr/obj/usr/src/sys/DWPC-KERNEL i386

Kernel configration

machine		i386
cpu		I686_CPU
ident		DWPC-200609101954

# To statically compile in device wiring instead of /boot/device.hints

makeoptions	DEBUG=-g		# Build kernel with gdb(1) debug symbols

options		KDB
options		KDB_TRACE
options		KDB_UNATTENDED
options		DDB
options		INVARIANT_SUPPORT
options		INVARIANTS
options		WITNESS

options 	SCHED_ULE		# ULE scheduler
options 	PREEMPTION		# Enable kernel thread preemption
options 	INET			# InterNETworking
options		NETGRAPH
options 	ALTQ_CBQ	# Class Bases Queueing
options 	ALTQ_RED	# Random Early Detection
options 	ALTQ_RIO	# RED In/Out
options 	ALTQ_HFSC	# Hierarchical Packet Scheduler
options 	ALTQ_CDNR	# Traffic conditioner
options 	ALTQ_PRIQ	# Priority Queueing
options 	ALTQ_DEBUG
options		MAC			# Framework for Mandatory Access Control
options 	FFS			# Berkeley Fast Filesystem
options 	SOFTUPDATES		# Enable FFS soft updates support
options 	UFS_ACL			# Support for access control lists
options 	UFS_DIRHASH		# Improve performance on big directories
options 	MD_ROOT			# MD is a potential root device
options 	NFSCLIENT		# Network Filesystem Client
options 	NFSSERVER		# Network Filesystem Server
options 	NFS_ROOT		# NFS usable as /, requires NFSCLIENT
options 	MSDOSFS			# MSDOS Filesystem
options 	CD9660			# ISO 9660 Filesystem
options 	PROCFS			# Process filesystem (requires PSEUDOFS)
options 	PSEUDOFS		# Pseudo-filesystem framework
options 	GEOM_GPT		# GUID Partition Tables.
options 	COMPAT_43		# Compatible with BSD 4.3 [KEEP THIS!]
options 	COMPAT_FREEBSD4		# Compatible with FreeBSD4
options 	COMPAT_FREEBSD5		# Compatible with FreeBSD5
options 	SCSI_DELAY=5000		# Delay (in ms) before probing SCSI
options 	KTRACE			# ktrace(1) support
options 	SYSVSHM			# SYSV-style shared memory
options 	SYSVMSG			# SYSV-style message queues
options 	SYSVSEM			# SYSV-style semaphores
options 	_KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options 	KBD_INSTALL_CDEV	# install a CDEV entry in /dev
options 	AHC_REG_PRETTY_PRINT	# Print register bitfields in debug
									# output.  Adds ~128k to driver.
options 	AHD_REG_PRETTY_PRINT	# Print register bitfields in debug
					# output.  Adds ~215k to driver.
options 	ADAPTIVE_GIANT			# Giant mutex is adaptive.

device		apic					# I/O APIC

# Bus support.
device		pci

# Floppy drives

# ATA and ATAPI devices
device		ata
device		atapicam	#ATAPI CAM interface for CDs and DVDs etc
device		atadisk		# ATA disk drives
device		atapicd		# ATAPI CDROM drives
options 	ATA_STATIC_ID	# Static device numbering

# SCSI Controllers

# SCSI peripherals
device		scbus		# SCSI bus (required for SCSI)
device		da		# Direct Access (disks)
device		cd		# CD
device		pass		# Passthrough device (direct SCSI access)

# RAID controllers interfaced to the SCSI subsystem

# RAID controllers

# atkbdc0 controls both the keyboard and the PS/2 mouse
device		atkbdc		# AT keyboard controller
device		atkbd		# AT keyboard
device		psm		# PS/2 mouse

device		kbdmux		# keyboard multiplexer

device		vga		# VGA video card driver

device		splash		# Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device		sc

# Enable this for the pcvt (VT220 compatible) console driver

device		agp		# support several AGP chipsets

# Power management support (see NOTES for more options)
#device		apm
# Add suspend/resume support for the i8254.
device		pmtimer

# PCCARD (PCMCIA) support
# PCMCIA and cardbus bridge support

# Serial (COM) ports
device		sio		# 8250, 16[45]50 based serial ports

# Parallel port
device		ppc
device		ppbus		# Parallel port bus (required)
device		lpt		# Printer
device		ppi		# Parallel port interface device

# If you've got a "dumb" serial or parallel PCI card that is
# supported by the puc(4) glue driver, uncomment the following
# line to enable it (connects to the sio and/or ppc drivers):

# PCI Ethernet NICs.

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device		miibus		# MII bus support
device		fxp		# Intel EtherExpress PRO/100B (82557, 82558)

# ISA Ethernet NICs.  pccard NICs included.
# 'device ed' requires 'device miibus'

# ISA devices that use the old ISA shims

# Wireless NIC cards

# Pseudo devices.
device		loop		# Network loopback
device		random		# Entropy device
device		ether		# Ethernet support
device		ppp		# Kernel PPP
device		tun		# Packet tunnel.
device		pty		# Pseudo-ttys (telnet etc)
device		md		# Memory "disks"
device		gif		# IPv6 and IPv4 tunneling
device		faith		# IPv6-to-IPv4 relaying (translation)

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device		bpf		# Berkeley packet filter

# USB support
device		uhci		# UHCI PCI->USB interface
device		ehci		# EHCI PCI->USB interface (USB 2.0)
device		usb		# USB Bus (required)
device		ugen		# Generic
device		uhid		# "Human Interface Devices"
device		ukbd		# Keyboard
device		umass		# Disks/Mass storage - Requires scbus and da
device		ums		# Mouse
# USB Ethernet, requires miibus
device		aue		# ADMtek USB Ethernet

# FireWire support
	
>Description:

lock order reversal:
 1st 0xc06c6a40 cdev (cdev) @ /usr/src/sys/kern/kern_conf.c:61
 2nd 0xc3281718 sleep mtxpool (sleep mtxpool) @ /usr/src/sys/kern/kern_prot.c:1877
KDB: stack backtrace:
kdb_backtrace(0,ffffffff,c06d77c8,c06d6f58,c06a1b04,...) at kdb_backtrace+0x29
witness_checkorder(c3281718,9,c0668211,755) at witness_checkorder+0x578
_mtx_lock_flags(c3281718,0,c0668211,755,c4c32700,...) at _mtx_lock_flags+0x78
crhold(c4a4ca00,deaf593e,deaf58b0,deaf5bf4,deaf5828,...) at crhold+0x1b
make_dev_credv(c06a79c0,0,c4a4ca00,0,0,...) at make_dev_credv+0xc6
make_dev_cred(c06a79c0,0,c4a4ca00,0,0,...) at make_dev_cred+0x21
pty_clone(0,c4a4ca00,deaf593e,5,deaf58b0,c329638c,0,c0660f31,212) at pty_clone+0xee
devfs_lookupx(deaf59d0,c349ce10,c0660f31,23f,c069a300,...) at devfs_lookupx+0x2bc
devfs_lookup(deaf59d0) at devfs_lookup+0x2d
VOP_LOOKUP_APV(c069a300,deaf59d0) at VOP_LOOKUP_APV+0x87
lookup(deaf5bcc) at lookup+0x47a
namei(deaf5bcc) at namei+0x376
vn_open_cred(deaf5bcc,deaf5ccc,0,c4a4ca00,c,...) at vn_open_cred+0x2a0
vn_open(deaf5bcc,deaf5ccc,0,c) at vn_open+0x1e
kern_open(c55b1190,8197850,0,3,0,...) at kern_open+0xb6
open(c55b1190,deaf5d04) at open+0x1a
syscall(805003b,810003b,bfbf003b,805c000,0,...) at syscall+0x22f
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (5, FreeBSD ELF32, open), eip = 0x2940c4f3, esp = 0xbfbfd3cc, ebp = 0xbfbfd3f8 ---

>How-To-Repeat: Unknown
>Fix: