NetBSD Problem Report #60720

From www@netbsd.org  Fri Sep 11 23:21:07 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id F2ABC1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 11 Sep 2026 23:21:06 +0000 (UTC)
Message-Id: <20260911232105.E2B0E1A923C@mollari.NetBSD.org>
Date: Fri, 11 Sep 2026 23:21:05 +0000 (UTC)
From: raytran08@gmail.com
Reply-To: raytran08@gmail.com
To: gnats-bugs@NetBSD.org
Subject: mac68k: ascaudio(4) takes its interrupt before initialising the lock the handler enters
X-Send-Pr-Version: www-1.0
X-From4GNATS: "raytran08@gmail.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60720
>Category:       port-mac68k
>Synopsis:       mac68k: ascaudio(4) takes its interrupt before initialising the lock the handler enters
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    nat
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 11 23:25:00 +0000 2026
>Closed-Date:    Thu Oct 15 15:36:11 +0000 2026
>Last-Modified:  Thu Oct 15 15:36:11 +0000 2026
>Originator:     Ray Tran
>Release:        11.0
>Organization:
Diamond Creek Digital
>Environment:
Hardware: Apple Macintosh Centris 650
Kernel: NetBSD 11.0 and CURRENT
>Description:
ascaudioattach() registers the interrupt handler and enables the
interrupt, and only then initialises sc_lock, sc_intr_lock and the two
callouts.  ascaudio_intr() enters sc_intr_lock, so during that window a
sound interrupt would take an uninitialised mutex.

Today the code is unreachable: the chip is in MODESTOP so its own interrupt
is quiet, and the handler returns early while no transfer is active.
That is luck rather than design.  The VIA2 mirror interrupt described in
port-mac68k/60701 arrives on this line on the Centris and Quadra 650
regardless of the chip's state, and any future change that touches the
chip or the lock in the handler before the early return would find the
window.  The convention throughout the tree is that a handler's locks
exist before the handler can run.
>How-To-Repeat:
By inspection: sys/arch/mac68k/obio/ascaudio.c, ascaudioattach(), the
intr_establish()/via2_register_irq() and ascaudio_intr_enable() calls
precede mutex_init() and callout_init().
>Fix:
pplies to sys/arch/mac68k/obio/ascaudio.c.  It is independent of
port-mac68k/60701 and 60702, which change other parts of the file.
The patched driver builds under NetBSD 11.0.  The same patch applies to
-current.


Applies with "patch -p1" from the top of usr/src; verified with -F0
(no fuzz) against NetBSD-current 11.99.8 (20260830003849Z) and 11.0.

--- a/sys/arch/mac68k/obio/ascaudio.c
+++ b/sys/arch/mac68k/obio/ascaudio.c
@@ -273,13 +273,6 @@

 	bus_space_write_1(sc->sc_tag, sc->sc_handle, ASCMODE, MODESTOP);

-	if (mac68k_machine.aux_interrupts) {
-		intr_establish(ascaudio_intr_est, sc, ASCIRQ);
-	} else {
-		via2_register_irq(VIA2_ASC, ascaudio_intr, sc);
-	}
-	ascaudio_intr_enable();
-
 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NONE);
 	mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_AUDIO);
 	callout_init(&sc->sc_pcallout, CALLOUT_MPSAFE);
@@ -287,6 +280,14 @@
 	callout_init(&sc->sc_rcallout, CALLOUT_MPSAFE);
 	callout_setfunc(&sc->sc_rcallout, ascaudio_done_input, sc);

+	/* The handler takes sc_intr_lock, so it goes live only now. */
+	if (mac68k_machine.aux_interrupts) {
+		intr_establish(ascaudio_intr_est, sc, ASCIRQ);
+	} else {
+		via2_register_irq(VIA2_ASC, ascaudio_intr, sc);
+	}
+	ascaudio_intr_enable();
+
 	sc->sc_vol = 180;
 	sc->sc_recvol = 255;


>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: port-mac68k-maintainer->nat
Responsible-Changed-By: nat@NetBSD.org
Responsible-Changed-When: Tue, 15 Sep 2026 00:42:12 +0000
Responsible-Changed-Why:
Take.


State-Changed-From-To: open->needs-pullups
State-Changed-By: nat@NetBSD.org
State-Changed-When: Wed, 16 Sep 2026 03:07:13 +0000
State-Changed-Why:
Patch applied.  Thanks to Ray Tran for the patch and for testing.


From: Nathanial Sloss <nathanialsloss@yahoo.com.au>
To: gnats-bugs@netbsd.org
Cc: netbsd-bugs@netbsd.org,
 gnats-admin@netbsd.org,
 raytran08@gmail.com
Subject: Re: port-mac68k/60720 (mac68k: ascaudio(4) takes its interrupt before initialising the lock the handler enters)
Date: Wed, 16 Sep 2026 15:55:12 +1000

 Opps....Forgot to quote the PR with the commit.

 CVS commit: src/sys/arch/mac68k/obio

     To: source-changes%NetBSD.org@localhost
         Subject: CVS commit: src/sys/arch/mac68k/obio
             From: "Nathanial Sloss" <nat%netbsd.org@localhost>
                 Date: Wed, 16 Sep 2026 02:55:04 +0000

                 Module Name:    src
                 Committed By:   nat
                 Date:           Wed Sep 16 02:55:04 UTC 2026

                 Modified Files:
                         src/sys/arch/mac68k/obio: ascaudio.c

                         Log Message:
                         Avoid use of lock before inited.

                         Patch and testing by Ray Tran.


                         To generate a diff of this commit:
                         cvs rdiff -u -r1.22 -r1.23 
 src/sys/arch/mac68k/obio/ascaudio.c

                         Please note that diffs are not public domain; they are 
 subject
 to the
                         copyright notices on the relevant files.

State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: nat@NetBSD.org
State-Changed-When: Wed, 14 Oct 2026 06:09:11 +0000
State-Changed-Why:
Pullup -11 #526


State-Changed-From-To: pending-pullups->closed
State-Changed-By: nat@NetBSD.org
State-Changed-When: Thu, 15 Oct 2026 15:36:11 +0000
State-Changed-Why:
Pullups complete.  Thanks for the report and patch.


>Unformatted:

Home	PR Database Search