NetBSD Problem Report #40551

From www@NetBSD.org  Wed Feb  4 11:54:25 2009
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by narn.NetBSD.org (Postfix) with ESMTP id 3675363C07D
	for <gnats-bugs@gnats.netbsd.org>; Wed,  4 Feb 2009 11:54:25 +0000 (UTC)
Message-Id: <20090204115424.B8C6B63B879@narn.NetBSD.org>
Date: Wed,  4 Feb 2009 11:54:24 +0000 (UTC)
From: raymond.meyer@rambler.ru
Reply-To: raymond.meyer@rambler.ru
To: gnats-bugs@NetBSD.org
Subject: Kernel panic in audio_init_ringbuffer
X-Send-Pr-Version: www-1.0

>Number:         40551
>Category:       kern
>Synopsis:       Kernel panic in audio_init_ringbuffer
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    nat
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 04 11:55:00 +0000 2009
>Closed-Date:    Tue Mar 14 06:55:52 +0000 2017
>Last-Modified:  Tue Mar 14 06:55:52 +0000 2017
>Originator:     RM
>Release:        
>Organization:
>Environment:
NetBSD ultra10 5.0_BETA NetBSD 5.0_BETA (GENERIC) #0: Tue Feb  3 22:04:11 GMT 2009  root@p3smp:/opt/obj.sparc64/sys/arch/sparc64/compile/GENERIC sparc64
>Description:
(gdb) target kvm /opt/crash/netbsd.0.core
#0  dumpsys () at /opt/src/sys/arch/sparc64/sparc64/machdep.c:755
755                         "partition too small?)\n", major(dumpdev), minor(dumpdev));
(gdb) where
#0  dumpsys () at /opt/src/sys/arch/sparc64/sparc64/machdep.c:755
#1  0x000000000142be18 in cpu_reboot (howto=256, user_boot_string=0x0)
    at /opt/src/sys/arch/sparc64/sparc64/machdep.c:623
#2  0x00000000012ee65c in panic (
    fmt=0x1663988 "audio_init_ringbuffer: blksize")
    at /opt/src/sys/kern/subr_prf.c:255
#3  0x000000000128c3c0 in audio_init_ringbuffer (sc=0xc60cb60, rp=0xc60cf68, 
    mode=2) at /opt/src/sys/dev/audio.c:1274
#4  0x000000000128c3f8 in audio_initbufs (sc=0xc60cb60)
    at /opt/src/sys/dev/audio.c:1300
#5  0x000000000128f5c4 in audiosetinfo (sc=0xc60cb60, ai=0xdda02d0)
    at /opt/src/sys/dev/audio.c:3584
#6  0x00000000012914f4 in audioioctl (dev=<value optimized out>, 
    cmd=3230155030, addr=0xdda02d0, flag=2, l=0xde25b60)
    at /opt/src/sys/dev/audio.c:1151
#7  0x00000000012e49d8 in cdev_ioctl (dev=5, cmd=3230155030, data=0xdda02d0, 
    flag=2, l=0xde25b60) at /opt/src/sys/kern/subr_devsw.c:811
#8  0x000000000133594c in VOP_IOCTL (vp=0xd4d5cc0, command=3230155030, 
    data=0xdda02d0, fflag=2, cred=0xd6b7a30)
    at /opt/src/sys/kern/vnode_if.c:562
#9  0x00000000013303ec in vn_ioctl (fp=0xdb303e0, com=3230155030, 
    data=0xdda02d0) at /opt/src/sys/kern/vfs_vnops.c:648
#10 0x00000000012f5ec4 in sys_ioctl (l=<value optimized out>, uap=0xddaddc0, 
    retval=0xddade00) at /opt/src/sys/kern/sys_generic.c:616
#11 0x0000000001435c70 in syscall_plain (tf=0xddaded0, 
    code=<value optimized out>, pc=1111754676)
    at /opt/src/sys/sys/syscallvar.h:49
#12 0x00000000010092ac in syscall_setup ()
#13 0x00000000010092ac in syscall_setup ()
Previous frame identical to this frame (corrupt stack?)
(gdb) up 3
(gdb) list
1269            DPRINTF(("audio_init_ringbuffer: MI blksize=%d\n", blksize));
1270            if (sc->hw_if->round_blocksize)
1271                    blksize = sc->hw_if->round_blocksize(sc->hw_hdl, blksize,
1272                                                         mode, &rp->s.param);
1273            if (blksize <= 0)
1274                    panic("audio_init_ringbuffer: blksize");
1275            nblks = rp->s.bufsize / blksize;
1276    
1277            DPRINTF(("audio_init_ringbuffer: final blksize=%d\n", blksize));
1278            rp->blksize = blksize;
(gdb) 
>How-To-Repeat:
I can reproduce this problem every time on NetBSD 5.0_BETA sparc64

Build and install from pkgsrc
audio/xmms
audio/xmms-faad

Start Xorg server + desktop environment, run xmms, configure xmms to use xmms-faad plugin, then load .mp4 audio file and play it.

As soon as you hit play, the kernel panics.
>Fix:

>Release-Note:

>Audit-Trail:
From: Kooda <kooda@upyum.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/40551
Date: Sun, 29 Dec 2013 21:29:35 +0100

 I stumbled upon this panic today while trying the mpv multimedia player.
 I later discovered that it was caused by the SDL audio output driver,
 inside the OBSD_OpenAudio function of the bsdaudio driver of the SDL
 audio subsystem.

 I tried to find the relevant part of that function that caused the panic
 and I wrote a tine program that does.

 The panic only appears on my laptop, which has this audio device:

 auich0 at pci0 dev 31 function 5: i82801DB/DBM (ICH4/ICH4M) AC-97 Audio
 auich0: interrupting at ioapic0 pin 17
 auich0: ac97: Analog Devices AD1981B codec; headphone, 20 bit DAC, no 3D stereo
 auich0: ac97: ext id 0x601<AC97_22,AMAP,VRA>
 auich0: measured ac97 link rate at 47998 Hz, will use 48000 Hz
 audio0 at auich0: full duplex, playback, capture, mmap, independent


 The panic is caused by the ioctl:

 #include <fcntl.h>
 #include <stdio.h>
 #include <sys/ioctl.h>
 #include <sys/audioio.h>

 int
 main() {
 	int audio_fd;
 	audio_info_t info;

 	AUDIO_INITINFO(&info);

 	audio_fd = open("/dev/audio0", O_WRONLY | O_NONBLOCK);

 	if (audio_fd < 0)
 		return 1;

 	AUDIO_INITINFO(&info);
 	info.play.sample_rate = 44100;
 	info.blocksize = 4;
 	info.hiwat = 5;
 	info.lowat = 3;
 	if(ioctl(audio_fd, AUDIO_SETINFO, &info) < 0)
 		return 2;

 	return 0;
 }

 -- 
 Envoyé depuis ma GameBoy.

 PGP key: D674 0670 BF8E 6A82 43C0 F317 AEC9 29D0 E8D7 F7B7

From: Kooda <kooda@upyum.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/40551
Date: Mon, 30 Dec 2013 10:24:09 +0100

 Apparently, preventing auich_round_blocksize (sys/dev/pci/auich.c) from
 returning a 0 value seems to prevent the panic, but the software that
 toggled it is then unable to play any sound (other software is fine
 though).

 Can any experienced developper take a look at this please?

 -- 
 Envoyé depuis ma GameBoy.

 PGP key: D674 0670 BF8E 6A82 43C0 F317 AEC9 29D0 E8D7 F7B7

From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
	netbsd-bugs@netbsd.org, raymond.meyer@rambler.ru
Subject: Re: kern/40551
Date: Mon, 30 Dec 2013 10:38:55 +0100

 It should not panic, but instead fail the ioctl call.

 Why is the software you are using trying to set such tiny values?
 Does the real code at least initialize the encoding used? Your sample
 program does not do that.

 Martin

From: Kooda <kooda@upyum.com>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
	netbsd-bugs@netbsd.org, raymond.meyer@rambler.ru,
	Martin Husemann <martin@duskware.de>
Subject: Re: kern/40551
Date: Mon, 30 Dec 2013 11:09:16 +0100

 On Mon, Dec 30, 2013 at 09:40:00AM +0000, Martin Husemann wrote:
 >  It should not panic, but instead fail the ioctl call.

 Sure, but that’s not what happens here, sadly.


 >  Why is the software you are using trying to set such tiny values?
 >  Does the real code at least initialize the encoding used? Your sample
 >  program does not do that.
 >  
 >  Martin
 >  

 Yes, the encoding is setup before blocksize in the SDL audio code.
 My test code was a bit bigger than that when I first wrote it, and did
 the setup of the encoding and channels as well, it still triggered the
 panic.

 As for mpv trying to set such tiny block size, I have no idea, that’s
 what I found using gdb on it to find the call that triggered the panic.


 -- 
 Envoyé depuis ma GameBoy.

 PGP key: D674 0670 BF8E 6A82 43C0 F317 AEC9 29D0 E8D7 F7B7

Responsible-Changed-From-To: kern-bug-people->nat
Responsible-Changed-By: nat@NetBSD.org
Responsible-Changed-When: Mon, 23 Jan 2017 21:24:57 +0000
Responsible-Changed-Why:
I'll handle this.


State-Changed-From-To: open->feedback
State-Changed-By: nat@NetBSD.org
State-Changed-When: Mon, 23 Jan 2017 21:24:57 +0000
State-Changed-Why:
Recent changes to audio have been committed.
See PR kern/51707.  I believe this applies to this PR also.


From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/40551
Date: Tue, 24 Jan 2017 06:29:39 +0100

 Since part of the issue was driver specific, which sparc64 audio hardware
 did you use?

 Martin

State-Changed-From-To: feedback->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Tue, 14 Mar 2017 06:55:52 +0000
State-Changed-Why:
The original submitter's mail is bouncing, so I guess we aren't going to
find out.


>Unformatted:

Home	PR Database Search