Kernel panic related to memory management on sparc

[Martin Lambers <marlam@web.de>]

Because I cannot send mail from my OpenBSD box, I cannot use sendbug,
so I'm trying to resemble it's output.

To: gnats@openbsd.org
Subject: 
From: marlam@web.de
Cc: 
Reply-To: marlam@web.de
X-sendbug-version: 3.97


>Submitter-Id:  net
>Originator:    Martin Lambers
>Organization:
net
>Confidential:  no
>Synopsis:      Kernel panic realted to memory allocating on sparc
>Severity:      critical
>Priority:      high
>Category:      OpenBSD
>Class:         sw-bug
>Release:       3.0
>Environment:
        System      : OpenBSD 3.0
        Architecture: OpenBSD.sparc
        Machine     : sparc (Standard SparcStation 2, 64 MB RAM)
>Description:
        I wrote a small C programm that allocates a number of 1 MB chunks 
        of memory (62 on my SparcStation with 64MB, because malloc() fails on no. 63) 
        and then begins to fill every chunk with zeros.
        While filling a chunk between no. 40 and 45 (number varies, but
        i never got beyond 45), the machine crashes. Kernel panic. The panic
        output is:
        --
        panic: vref used where vget required
        syncing disks... 6 6 2 done
        Frame pointer is at 0xf9f09890
        Call traceback:
          pc = 0xf818fb28  args = (0x0, 0x1008, 0xf81c6400, 0x0, 0xf9f099a8, 0x0, 0xf9f098f8) fp = 0xf9f098f8
          pc = 0xf803ea24  args = (0x100, 0xf9f09a10, 0xf9f09a10, 0x0, 0x0, 0xa8, 0xf9f09960) fp = 0xf9f09960
          pc = 0xf8060f58  args = (0xf8060f20, 0x100, 0xf9f04138, 0xf9f08220, 0x0, 0xf9f09a3c, 0xf9f099c8) fp = 0xf9f099c8
          pc = 0xf81419e4  args = (0xf9fa7738, 0x0, 0x3, 0xffffffff, 0xf9f09a3c, 0x1f0, 0xf9f09a30) fp = 0xf9f09a30
          pc = 0xf811dc24  args = (0xf9fa7738, 0x1000, 0x0, 0x0, 0x0, 0xffffffff, 0xf9f09a98) fp = 0xf9f09a98
          pc = 0xf80689bc  args = (0x0, 0x0, 0xf9fa7738, 0xf9f09b80, 0x1000, 0x0, 0xf9f09b20) fp = 0xf9f09b20
          pc = 0xf81418e8  args = (0xf9fa7738, 0xf9f09c08, 0x0, 0xf8323b00, 0x0, 0xf9f09ccc, 0xf9f09ba0) fp = 0xf9f09ba0
          pc = 0xf8141408  args = (0xf9fa7738, 0x1000, 0x1, 0x1000, 0x1, 0x0, 0xf9f09c30) fp = 0xf9f09c30
          pc = 0xf813bd3c  args = (0xf9fa7738, 0xf9f09dd0, 0x1, 0x0, 0xf81413f4, 0x0, 0xf9f09c98) fp = 0xf9f09c98
          pc = 0xf813ca00  args = (0xf9fa7738, 0xf822c570, 0x0, 0xf9f09d84, 0x90, 0xf9f09dd0, 0xf9f09d10) fp = 0xf9f09d10
          pc = 0xf813cd34  args = (0x0, 0x7e, 0x0, 0xf81f46cc, 0xf81e6c00, 0x0, 0xf9f09e18) fp = 0xf9f09e18
          pc = 0xf813c3d4  args = (0xaa, 0x7e, 0x1243, 0x0, 0xffffffff, 0x3, 0xf9f09e80) fp = 0xf9f09e80
          pc = 0xf8025080  args = (0x0, 0x11, 0xf805c568, 0x0, 0x0, 0xa8, 0xf9f09ee8) fp = 0xf9f09ee8
          pc = 0xf800775c  args = (0x0, 0x30000000, 0xf9f04000, 0xf81ddbc8, 0x0, 0xf9f01000, 0xf9f09f50) fp = 0xf9f09f50
          pc = 0x0  args = (0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) fp = 0x0
        --
        I run a freshly installed OpenBSD 3.0 system without
        modifications, except that i don not use the GENERIC kernel but
        one that only contains what a SS2 needs.
>How-To-Repeat:
        This is the C programm. I compiled it with gcc from OpenBSD 3.0.
        --
        #include <stdio.h>
        #include <stdlib.h>

        #define NUM_OF_CHUNKS 62

        int main(void)
        {
            int i, j;
            char *chunk[NUM_OF_CHUNKS];
            
            fprintf(stderr, "Allocating %d chunks:\n", NUM_OF_CHUNKS);
            for (i = 0; i < NUM_OF_CHUNKS; i++)
            {
                fprintf(stderr, "%d\n", i);
                chunk[i] = malloc(1024 * 1024);
                if (!(chunk[i]))
                {
                    fprintf(stderr, "failed!\n");
                    exit(1);
                }
            }

            fprintf(stderr, "Accessing chunks...\n");
            for (i = 0; i < NUM_OF_CHUNKS; i++)
            {
                fprintf(stderr, "%d\n", i);
                for (j = 0; j < 1024 * 1024; j++)
                {
                    chunk[i][j] = '\0';
                }
            }
        
            return 0;
        }
        --
>Fix:   ?