NetBSD Problem Report #45664

From martin@duskware.de  Sun Nov 27 14:37:34 2011
Return-Path: <martin@duskware.de>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id EAC9C63D970
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 27 Nov 2011 14:37:33 +0000 (UTC)
Message-Id: <20111127143733.EAC9C63D970@www.NetBSD.org>
Date: Sun, 27 Nov 2011 14:37:33 +0000 (UTC)
From: martin@NetBSD.org
Reply-To: martin@NetBSD.org
To: gnats-bugs@gnats.NetBSD.org
Subject: audio detach failure
X-Send-Pr-Version: 3.95

>Number:         45664
>Category:       kern
>Synopsis:       audio panic at detach
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 27 14:40:00 +0000 2011
>Closed-Date:    Mon Nov 28 12:29:27 +0000 2011
>Last-Modified:  Mon Nov 28 12:29:27 +0000 2011
>Originator:     Martin Husemann
>Release:        NetBSD 5.99.57
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD after-hours.aprisoft.de 5.99.57 NetBSD 5.99.57 (MODULAR) #75: Sun Nov 27 09:35:46 CET 2011  martin@after-hours.aprisoft.de:/usr/src/sys/arch/sparc64/compile/MODULAR sparc64
Architecture: sparc64
Machine: sparc64
>Description:

When rebooting -current I get an assertion failure bt != NULL in 

0x142b0e8 is in vmem_xfree (../../../../kern/subr_vmem.c:1092).
1087            KASSERT(size > 0);
1088    
1089            VMEM_LOCK(vm);
1090    
1091            bt = bt_lookupbusy(vm, addr);
1092            KASSERT(bt != NULL);
1093            KASSERT(bt->bt_start == addr);
1094            KASSERT(bt->bt_size == vmem_roundup_size(vm, size) ||
1095                bt->bt_size - vmem_roundup_size(vm, size) <= vm->vm_quantum_mask);
1096            KASSERT(bt->bt_type == BT_TYPE_BUSY);

with this backtrace:

vmem_xfree(4205000, 3bd6170, 10000, 0, e37ba50, 17b7680) at netbsd:vmem_xfree+0x
1c8
audio_free_ring(3bf2590, 3bf2960, e2ccc00, 1, ff, 18ccba8) at netbsd:audio_free_
ring+0x24
audiodetach(3bf3190, 4, ff070000000001, 0, e37bb18, 17b15c0) at netbsd:audiodeta
ch+0x110
config_detach(3bf3190, 4, ff0f0000000001, 0, e37bbc8, 1809c00) at netbsd:config_
detach+0xc0
config_detach_all(808, 0, 0, 0, 17b0508, 17b04d8) at netbsd:config_detach_all+0x
80
cpu_reboot(808, 0, 0, 0, 0, 0) at netbsd:cpu_reboot+0x264
sys_reboot(0, e37bdd0, e37be10, 1, 0, 40414f28) at netbsd:sys_reboot+0x50
syscall_plain(e37bed0, e37bdd0, 40744ab8, ffffffffffffb361, 40744ab8, 2) at netb
sd:syscall_plain+0x134
?(808, 0, 101660, 5, 0, 4093f3c0) at 1008c48

I'm pretty sure /dev/audio has not been opeend at all since the last reboot.

>How-To-Repeat:
not sure yet

>Fix:
n/a

>Release-Note:

>Audit-Trail:
From: Martin Husemann <martin@homeworld.netbsd.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/45664: audio detach failure
Date: Mon, 28 Nov 2011 09:38:32 +0000

 FYI, this is the audio hardware attaching:

 audiocs0 at ebus0 addr 200000-2000ff, 702000-70200f, 704000-70400f, 722000-722003 ipl 20 ipl 21: CS4231A
 audio0 at audiocs0: full duplex, playback, capture


 To repeat: just boot, don't touch any audio, shutdown -r now

 Martin

From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/45664: audio detach failure
Date: Mon, 28 Nov 2011 11:01:58 +0100

 And the backtrace expanded:

 0x108a2c4 is in audio_free_ring (../../../../dev/audio.c:904).
 899     {
 900             if (r->s.start == 0)
 901                     return;
 902     
 903             if (sc->hw_if->freem)
 904                     sc->hw_if->freem(sc->hw_hdl, r->s.start, r->s.bufsize);
 905             else
 906                     kmem_free(r->s.start, r->s.bufsize);
 907             r->s.start = 0;
 908     }

 0x108a410 is in audiodetach (../../../../dev/audio.c:730).
 725     #endif
 726     
 727             pmf_device_deregister(self);
 728     
 729             /* free resources */
 730             audio_free_ring(sc, &sc->sc_pr);
 731             audio_free_ring(sc, &sc->sc_rr);
 732             for (i = 0; i < sc->sc_nrfilters; i++) {
 733                     sc->sc_rfilters[i]->dtor(sc->sc_rfilters[i]);
 734                     sc->sc_rfilters[i] = NULL;

 Martin

From: "Jared D. McNeill" <jmcneill@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/45664 CVS commit: src/sys/dev/ic
Date: Mon, 28 Nov 2011 11:46:54 +0000

 Module Name:	src
 Committed By:	jmcneill
 Date:		Mon Nov 28 11:46:54 UTC 2011

 Modified Files:
 	src/sys/dev/ic: cs4231.c

 Log Message:
 PR# kern/45664: audio panic at detach

 Pass the size of the structure to kmem_free, not the size of the DMA
 buffer.


 To generate a diff of this commit:
 cvs rdiff -u -r1.27 -r1.28 src/sys/dev/ic/cs4231.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: martin@NetBSD.org
State-Changed-When: Mon, 28 Nov 2011 12:29:27 +0000
State-Changed-Why:
Works, thanks for the quick fix!


>Unformatted:

Home	PR Database Search