NetBSD Problem Report #52424

From gson@gson.org  Sat Jul 22 22:02:22 2017
Return-Path: <gson@gson.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 588487A173
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 22 Jul 2017 22:02:22 +0000 (UTC)
Message-Id: <20170722220214.48F2374527D@guava.gson.org>
Date: Sun, 23 Jul 2017 01:02:14 +0300 (EEST)
From: gson@gson.org (Andreas Gustafsson)
Reply-To: gson@gson.org (Andreas Gustafsson)
To: gnats-bugs@NetBSD.org
Subject: Panic running usr.bin/mixerctl/t_mixerctl test
X-Send-Pr-Version: 3.95

>Number:         52424
>Category:       kern
>Synopsis:       Panic running usr.bin/mixerctl/t_mixerctl test
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    nat
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jul 22 22:05:00 +0000 2017
>Closed-Date:    Fri Oct 27 20:45:42 +0000 2017
>Last-Modified:  Mon Apr 16 14:15:01 +0000 2018
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current
>Organization:
>Environment:
System: NetBSD 
Architecture: i386
Machine: i386
>Description:

Recently, several runs of the automated i386 ATF test runs on
babylon5.netbsd.org have ended in a kernel panic during the
usr.bin/mixerctl/t_mixerctl test.  For example, the log file

  http://releng.netbsd.org/b5reports/i386/build/2017.07.20.18.17.25/test.log

contains:

  usr.bin/mixerctl/t_mixerctl (522/716): 4 test cases
      nflag: pad0: outputs: 44100Hz, 16-bit, stereo
  audio0 at pad0: half duplex, playback, capture, mmap
  pad0: Virtual format configured - Format SLINEAR, precision 16, channels 2, frequency 44100
  audio0: detached
  pad0: detached
  [4.551921s] Passed.
      noargs_usage: pad0: outputs: 44100Hz, 16-bit, stereo
  audio0 at pad0: half duplex, playback, capture, mmap
  pad0: Virtual format configured - Format SLINEAR, precision 16, channels 2, frequency 44100
  audio0: detached
  pad0: detached
  [2.913791s] Passed.
      nonexistant_device: [1.826129s] Passed.
      showvalue: pad0: outputs: 44100Hz, 16-bit, stereo
  audio0 at pad0: half duplex, playback, capture, mmap
  pad0: Virtual format configured - Format SLINEAR, precision 16, channels 2, frequency 44100
  uvm_fault(0xc1309d00, 0xc8d60000, 1) -> 0xe
  fatal page fault in supervisor mode
  trap type 6 code 0 eip 0xc06f6393 cs 0x8 eflags 0x297 cr2 0xc8d60288 ilevel 0 esp 0xc2627000
  curlwp 0xc1cdf2a0 pid 16394 lid 1 lowest kstack 0xc8c6c2c0
  panic: trap
  cpu0: Begin traceback...
  vpanic(c0f7a55a,c8c6ec44,c8c6ecc0,c012074f,c0f7a55a,c8c6eccc,c8c6eccc,1,c8c6c2c0,297) at netbsd:vpanic+0x121
  snprintf(c0f7a55a,c8c6eccc,c8c6eccc,1,c8c6c2c0,297,c8d60288,0,c2627000,0) at netbsd:snprintf
  trap() at netbsd:trap+0xd90
  --- trap (number 6) ---
  audio_query_devinfo(c2216008,c32c4d02,c2148408,3,c1cdf2a0,c0943ec5,32c,1,c1e30280,c2216008) at netbsd:audio_query_devinfo+0x51
  audioioctl(c1aba4c0,c32c4d02,c2148408,0,0,c8c6ee9c,3,ffffffff,32c,c2148408) at netbsd:audioioctl+0x118
  sys_ioctl(c1cdf2a0,c8c6ef68,c8c6ef60,c1e30280,b081c000,c8c6ef60,c8c6ef68,36,0,0) at netbsd:sys_ioctl+0xfc
  syscall() at netbsd:syscall+0x1ed
  --- syscall (number 54) ---
  b081c327:
  cpu0: End traceback...

Grepping the logs for 2017 shows nine such crashes, all in July:

  babylon5.netbsd.org$ zgrep query_devinfo 2017*/test.log.gz
  2017.07.02.16.06.42/test.log.gz:audio_query_devinfo(c2118408,c32c4d02,c1b35008,3,c2309540,c0943365,32c,1,c2110280,c2118408) at netbsd:audio_query_devinfo+0x51
  2017.07.03.09.08.35/test.log.gz:audio_query_devinfo(c2124808,c32c4d02,c2222008,3,c2374d20,c0943765,32c,1,c21f9500,c2124808) at netbsd:audio_query_devinfo+0x51
  2017.07.08.18.38.57/test.log.gz:audio_query_devinfo(c211dc08,c32c4d02,c221b408,3,c21b5a80,c0943445,32c,1,c2258ad0,c211dc08) at netbsd:audio_query_devinfo+0x51
  2017.07.09.19.37.33/test.log.gz:audio_query_devinfo(c2135808,c32c4d02,c212f008,3,c1ce6aa0,c0943475,32c,1,c21126a4,c2135808) at netbsd:audio_query_devinfo+0x51
  2017.07.09.22.04.04/test.log.gz:audio_query_devinfo(c212f408,c32c4d02,c2216c08,3,c22422a0,c0943465,32c,1,c19ae27c,c212f408) at netbsd:audio_query_devinfo+0x51
  2017.07.13.16.46.43/test.log.gz:audio_query_devinfo(c1e11c08,c32c4d02,c2116808,3,c2385d40,c09439a5,32c,1,c21fe42c,c1e11c08) at netbsd:audio_query_devinfo+0x51
  2017.07.17.19.55.13/test.log.gz:audio_query_devinfo(c222ec08,c32c4d02,c2216408,3,c255a7e0,c0943a15,32c,1,c21f5c74,c222ec08) at netbsd:audio_query_devinfo+0x51
  2017.07.20.18.17.25/test.log.gz:audio_query_devinfo(c2216008,c32c4d02,c2148408,3,c1cdf2a0,c0943ec5,32c,1,c1e30280,c2216008) at netbsd:audio_query_devinfo+0x51
  2017.07.21.08.49.05/test.log.gz:audio_query_devinfo(c1af8c08,c32c4d02,c1add008,3,c2377800,c0943725,32c,1,c19af424,c1af8c08) at netbsd:audio_query_devinfo+0x51

>How-To-Repeat:

Run the usr.bin/mixerctl/t_mixerctl test repeatedly.

>Fix:

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->nat
Responsible-Changed-By: nat@NetBSD.org
Responsible-Changed-When: Mon, 24 Jul 2017 03:15:14 +0000
Responsible-Changed-Why:
Take.


From: Nathanial Sloss <nat@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org,
 netbsd-bugs@netbsd.org,
 gnats-admin@netbsd.org,
 Andreas Gustafsson <gson@gson.org>
Subject: Re: kern/52424 (Panic running usr.bin/mixerctl/t_mixerctl test)
Date: Mon, 24 Jul 2017 13:26:11 +1000

 --Boundary-00=_TjWdZgu0BDZNi5g
 Content-Type: Text/Plain;
   charset="iso-8859-15"
 Content-Transfer-Encoding: 7bit

 Please Try the attached patch to see if it solves the problem.

 Best regards,

 Nat


 --Boundary-00=_TjWdZgu0BDZNi5g
 Content-Type: text/x-patch;
   charset="iso-8859-15";
   name="mixerctl_t-audio.diff"
 Content-Transfer-Encoding: 7bit
 Content-Disposition: attachment;
 	filename="mixerctl_t-audio.diff"

 Index: src/sys/dev/audio.c
 ===================================================================
 RCS file: /cvsroot/src/sys/dev/audio.c,v
 retrieving revision 1.368
 diff -u -p -r1.368 audio.c
 --- src/sys/dev/audio.c	9 Jul 2017 12:08:39 -0000	1.368
 +++ src/sys/dev/audio.c	24 Jul 2017 03:23:20 -0000
 @@ -5807,6 +5807,9 @@ audio_query_devinfo(struct audio_softc *

  	KASSERT(mutex_owned(sc->sc_lock));

 +	if (sc->sc_static_nmixer_states == 0 || sc->sc_nmixer_states == 0)
 +		goto hardware;
 +
  	if (di->index >= sc->sc_static_nmixer_states - 1 &&
  	    di->index < sc->sc_nmixer_states) {
  		if (di->index == sc->sc_static_nmixer_states - 1) {
 @@ -5838,7 +5841,7 @@ audio_query_devinfo(struct audio_softc *
  		return 0;
  	}

 -
 +hardware:
  	return sc->hw_if->query_devinfo(sc->hw_hdl, di);
  }


 --Boundary-00=_TjWdZgu0BDZNi5g--

From: Andreas Gustafsson <gson@gson.org>
To: Nathanial Sloss <nat@netbsd.org>
Cc: gnats-bugs@netbsd.org
Subject: Re: kern/52424 (Panic running usr.bin/mixerctl/t_mixerctl test)
Date: Mon, 24 Jul 2017 19:39:37 +0300

 Nathanial Sloss wrote:
 > Please Try the attached patch to see if it solves the problem.

 I don't have an easy way of testing the patch.  The failures occurred
 on a system that is dedicated to automated testing of -current and
 does not support testing patches, and even there, the failure does not
 occur in every run.

 If you believe the patch is correct, I suggest you simply commit it
 so that it will be picked up by the automated tests.
 -- 
 Andreas Gustafsson, gson@gson.org

From: "Nathanial Sloss" <nat@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52424 CVS commit: src/sys/dev
Date: Tue, 25 Jul 2017 13:29:16 +0000

 Module Name:	src
 Committed By:	nat
 Date:		Tue Jul 25 13:29:16 UTC 2017

 Modified Files:
 	src/sys/dev: audio.c

 Log Message:
 Fix a panic caused by opening pad(4)'s mixer before the corresponding
 audio device has attached.

 Addresses PR kern/52424.


 To generate a diff of this commit:
 cvs rdiff -u -r1.368 -r1.369 src/sys/dev/audio.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: nat@NetBSD.org
State-Changed-When: Fri, 27 Oct 2017 20:45:42 +0000
State-Changed-Why:
This issue has been fixed.  Thanks for the PR!


From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/52424 CVS commit: [netbsd-8] src/sys/dev
Date: Mon, 16 Apr 2018 14:11:44 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Mon Apr 16 14:11:44 UTC 2018

 Modified Files:
 	src/sys/dev [netbsd-8]: auconv.c audio.c audiovar.h aurateconv.c

 Log Message:
 Pull up following revision(s) (requested by nat in ticket #759):

 	sys/dev/audio.c: revision 1.367
 	sys/dev/audio.c: revision 1.369
 	sys/dev/audio.c: revision 1.376 (patch)
 	sys/dev/audio.c: revision 1.377 (patch)
 	sys/dev/audio.c: revision 1.378
 	sys/dev/audio.c: revision 1.382 (patch)
 	sys/dev/audio.c: revision 1.383 (patch)
 	sys/dev/audio.c: revision 1.384
 	sys/dev/audio.c: revision 1.388
 	sys/dev/audio.c: revision 1.389
 	sys/dev/audio.c: revision 1.395
 	sys/dev/audio.c: revision 1.396 (patch)
 	sys/dev/audio.c: revision 1.397
 	sys/dev/audio.c: revision 1.403
 	sys/dev/audio.c: revision 1.451
 	sys/dev/audio.c: revision 1.452
 	sys/dev/audiovar.h: revision 1.59 (patch)
 	sys/dev/aurateconv.c: revision 1.21 (patch)
 	sys/dev/auconv.c: revision 1.31 (patch)
 	sys/dev/audiovar.h: revision 1.60 (patch)

 Broadcast all conditional variables if in being deactivated so no readers
 or writers get stuck.

 Fix a panic caused by opening pad(4)'s mixer before the corresponding
 audio device has attached.

 Addresses PR kern/52424.

 Improve audio_set_vchan_defaults().
 - Correct confused input/output parameters.
 - Remove sc->{sc_channels, sc_precision, sc_frequency}.  They are
   the same as sc->sc_vchan_params.{channels, precision, sample_rate}.
 The input parameter of audio_set_vchan_defaults() is now only
 sc->sc_vchan_params.

 Fix PR kern/52437

 const-ify.

 0 -> NULL in audioattach()

 "bits" sounds better than "name" for argument name.
 I feel expression (name / NBBY) a little strange.

 The audio module will now compile with WARNS=5.

 Typo in debug message.

 Remove a duplicated line.

 Add missing initialization of sc_rfilters in audioattach().

 Remove dead codes.

 sc->sc_opens never changes in this loop and as a result of
 previous sc_audiochan cleanup "sc_opens == 0" is the same as
 "sc_audiochan is empty".

 Clean up audio_allocbufs().

 As a result of sc_audiochan cleanup, it is easy to access sc_hwvc.

 Clean up audio_open().

 As a result of sc_audiochan cleanup, this loop is the same as last + 1.
 hw_if->set_params is mandatory, so it will never be NULL.

 CID-1427745: kill possible buffer overflows.

 Revert my wrong r1.380 and add a comment instead.


 To generate a diff of this commit:
 cvs rdiff -u -r1.26.2.4 -r1.26.2.5 src/sys/dev/auconv.c
 cvs rdiff -u -r1.357.2.10 -r1.357.2.11 src/sys/dev/audio.c
 cvs rdiff -u -r1.55.2.5 -r1.55.2.6 src/sys/dev/audiovar.h
 cvs rdiff -u -r1.19.42.1 -r1.19.42.2 src/sys/dev/aurateconv.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search