NetBSD Problem Report #56164

From www@netbsd.org  Wed May 12 21:45:45 2021
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 7B55A1A92AB
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 12 May 2021 21:45:45 +0000 (UTC)
Message-Id: <20210512214544.11BBB1A92AC@mollari.NetBSD.org>
Date: Wed, 12 May 2021 21:45:44 +0000 (UTC)
From: nia@pkgsrc.org
Reply-To: nia@pkgsrc.org
To: gnats-bugs@NetBSD.org
Subject: System panicked: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
X-Send-Pr-Version: www-1.0

>Number:         56164
>Category:       kern
>Synopsis:       System panicked: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          feedback
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 12 21:50:00 +0000 2021
>Closed-Date:    
>Last-Modified:  Sat Jul 10 04:32:44 +0000 2021
>Originator:     nia
>Release:        current
>Organization:
>Environment:
NetBSD amnesia 9.99.82 NetBSD 9.99.82 (GENERIC) #4: Tue May 11 18:10:14 CEST 2021  nia@amnesia:/src/obj/sys/arch/amd64/compile/GENERIC amd64
>Description:
I've seen this panic semi-frequently (~twice in the past ~48 hours).
I'll attempt to get a reasonable backtrace when it happens again.
Unfortunately none of the crash dumps I have are usable.

System panicked: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
>How-To-Repeat:
unknown, seems random
>Fix:

>Release-Note:

>Audit-Trail:
From: nia <nia@NetBSD.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 "(target->prt_class == class)" failed: file
 "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class:
 0x0 (ref) != 0xffffd2ef411bc940 (expected)
Date: Tue, 18 May 2021 13:17:12 +0000

 Gah, it appears to be audio (possibly uaudio) related.

 [  9180.811329] panic: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xfffff76135d8a080 (expected)
 [  9180.811329] cpu2: Begin traceback...
 [  9180.821329] vpanic() at netbsd:vpanic+0x230
 [  9180.821329] db_print_address.cold() at netbsd:db_print_address.cold
 [  9180.821329] psref_acquire() at netbsd:psref_acquire+0x4e0
 [  9180.831327] audio_sc_acquire_fromfile() at netbsd:audio_sc_acquire_fromfile+0xc6
 [  9180.831327] audioclose() at netbsd:audioclose+0x136
 [  9180.841327] closef() at netbsd:closef+0x17f
 [  9180.841327] fd_free() at netbsd:fd_free+0x3c5
 [  9180.841327] exit1() at netbsd:exit1+0x301
 [  9180.851327] sys_exit() at netbsd:sys_exit+0xb0
 [  9180.851327] syscall() at netbsd:syscall+0x26b
 [  9180.861328] --- syscall (number 1) ---
 [  9180.861328] netbsd:syscall+0x26b:
 [  9180.861328] cpu2: End traceback...

 Still don't have an intact dump, unfortunately...

From: Andrius V <vezhlys@gmail.com>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, 
	nia@pkgsrc.org
Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c",
 line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
Date: Tue, 18 May 2021 19:02:46 +0300

 Yes, I had similar crash on headset removal, mentioned in
 port-amd64/56172 thread. I easily reproduce by removing my Jabra
 headset while sound plays on audiocfg test.

 On Tue, May 18, 2021 at 4:20 PM nia <nia@netbsd.org> wrote:
 >
 > The following reply was made to PR kern/56164; it has been noted by GNATS.
 >
 > From: nia <nia@NetBSD.org>
 > To: gnats-bugs@netbsd.org
 > Cc:
 > Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 >  "(target->prt_class == class)" failed: file
 >  "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class:
 >  0x0 (ref) != 0xffffd2ef411bc940 (expected)
 > Date: Tue, 18 May 2021 13:17:12 +0000
 >
 >  Gah, it appears to be audio (possibly uaudio) related.
 >
 >  [  9180.811329] panic: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xfffff76135d8a080 (expected)
 >  [  9180.811329] cpu2: Begin traceback...
 >  [  9180.821329] vpanic() at netbsd:vpanic+0x230
 >  [  9180.821329] db_print_address.cold() at netbsd:db_print_address.cold
 >  [  9180.821329] psref_acquire() at netbsd:psref_acquire+0x4e0
 >  [  9180.831327] audio_sc_acquire_fromfile() at netbsd:audio_sc_acquire_fromfile+0xc6
 >  [  9180.831327] audioclose() at netbsd:audioclose+0x136
 >  [  9180.841327] closef() at netbsd:closef+0x17f
 >  [  9180.841327] fd_free() at netbsd:fd_free+0x3c5
 >  [  9180.841327] exit1() at netbsd:exit1+0x301
 >  [  9180.851327] sys_exit() at netbsd:sys_exit+0xb0
 >  [  9180.851327] syscall() at netbsd:syscall+0x26b
 >  [  9180.861328] --- syscall (number 1) ---
 >  [  9180.861328] netbsd:syscall+0x26b:
 >  [  9180.861328] cpu2: End traceback...
 >
 >  Still don't have an intact dump, unfortunately...
 >

From: Andrius V <vezhlys@gmail.com>
To: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, 
	nia@pkgsrc.org, gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c",
 line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
Date: Sat, 29 May 2021 00:23:53 +0300

 It seems that the problem may be caused by the race condition when
 file->dying is not yet set to true, but sc->sc_dying is already marked
 as true (probably by uaudio). Thus, this patch seems to fix my crash
 on jabra headset removal  (also mentioned in PR/56172 thread) and
 prevents from reaching psref_acquire, which causes assertion panic in
 subr_psref.c 296 or 299:

 diff --git a/sys/dev/audio/audio.c b/sys/dev/audio/audio.c
 index cb5eb00ccce..2e58457e58c 100644
 --- a/sys/dev/audio/audio.c
 +++ b/sys/dev/audio/audio.c
 @@ -1578,7 +1578,7 @@ audio_sc_acquire_fromfile(audio_file_t *file,
 struct psref *refp)

         /* If close or audiodetach already ran, tough -- no more audio */
         dying = atomic_load_relaxed(&file->dying);
 -       if (dying) {
 +       if (dying || file->sc->sc_dying) {
                 pserialize_read_exit(s);
                 return NULL;

         }

 On Tue, May 18, 2021 at 7:05 PM Andrius V <vezhlys@gmail.com> wrote:
 >
 > The following reply was made to PR kern/56164; it has been noted by GNATS.
 >
 > From: Andrius V <vezhlys@gmail.com>
 > To: gnats-bugs@netbsd.org
 > Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org, netbsd-bugs@netbsd.org,
 >         nia@pkgsrc.org
 > Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 >  "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c",
 >  line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
 > Date: Tue, 18 May 2021 19:02:46 +0300
 >
 >  Yes, I had similar crash on headset removal, mentioned in
 >  port-amd64/56172 thread. I easily reproduce by removing my Jabra
 >  headset while sound plays on audiocfg test.
 >
 >  On Tue, May 18, 2021 at 4:20 PM nia <nia@netbsd.org> wrote:
 >  >
 >  > The following reply was made to PR kern/56164; it has been noted by GNATS.
 >  >
 >  > From: nia <nia@NetBSD.org>
 >  > To: gnats-bugs@netbsd.org
 >  > Cc:
 >  > Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 >  >  "(target->prt_class == class)" failed: file
 >  >  "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class:
 >  >  0x0 (ref) != 0xffffd2ef411bc940 (expected)
 >  > Date: Tue, 18 May 2021 13:17:12 +0000
 >  >
 >  >  Gah, it appears to be audio (possibly uaudio) related.
 >  >
 >  >  [  9180.811329] panic: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xfffff76135d8a080 (expected)
 >  >  [  9180.811329] cpu2: Begin traceback...
 >  >  [  9180.821329] vpanic() at netbsd:vpanic+0x230
 >  >  [  9180.821329] db_print_address.cold() at netbsd:db_print_address.cold
 >  >  [  9180.821329] psref_acquire() at netbsd:psref_acquire+0x4e0
 >  >  [  9180.831327] audio_sc_acquire_fromfile() at netbsd:audio_sc_acquire_fromfile+0xc6
 >  >  [  9180.831327] audioclose() at netbsd:audioclose+0x136
 >  >  [  9180.841327] closef() at netbsd:closef+0x17f
 >  >  [  9180.841327] fd_free() at netbsd:fd_free+0x3c5
 >  >  [  9180.841327] exit1() at netbsd:exit1+0x301
 >  >  [  9180.851327] sys_exit() at netbsd:sys_exit+0xb0
 >  >  [  9180.851327] syscall() at netbsd:syscall+0x26b
 >  >  [  9180.861328] --- syscall (number 1) ---
 >  >  [  9180.861328] netbsd:syscall+0x26b:
 >  >  [  9180.861328] cpu2: End traceback...
 >  >
 >  >  Still don't have an intact dump, unfortunately...
 >  >
 >

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/56164 CVS commit: src/sys/dev/audio
Date: Tue, 1 Jun 2021 21:19:03 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Tue Jun  1 21:19:03 UTC 2021

 Modified Files:
 	src/sys/dev/audio: audio.c

 Log Message:
 audio(4): Insert mixers and audioctls into sc_files on open too.

 This is necessary so that on detach we set file->dying before any
 operations, particularly audioclose, try to acquire a psref by the
 time the audio softc is gone.

 Candidate fix for PR kern/56164.


 To generate a diff of this commit:
 cvs rdiff -u -r1.100 -r1.101 src/sys/dev/audio/audio.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sat, 10 Jul 2021 04:32:44 +0000
State-Changed-Why:
Did the commit help?


>Unformatted:

Home	PR Database Search