From devin@distalzou.net  Sat Mar 27 15:13:29 2010
Return-Path: <devin@distalzou.net>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E0D251065680
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 27 Mar 2010 15:13:29 +0000 (UTC)
	(envelope-from devin@distalzou.net)
Received: from mail.distalzou.net (203.141.139.231.static.zoot.jp [203.141.139.231])
	by mx1.freebsd.org (Postfix) with ESMTP id 76F5A8FC0C
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 27 Mar 2010 15:13:29 +0000 (UTC)
Received: from devin by mail.distalzou.net with local (Exim 4.71 (FreeBSD))
	(envelope-from <devin@distalzou.net>)
	id 1NvX9u-0000WH-7a; Sat, 27 Mar 2010 23:38:42 +0900
Message-Id: <E1NvX9u-0000WH-7a@mail.distalzou.net>
Date: Sat, 27 Mar 2010 23:38:42 +0900
From: Tod McQuillin <devin@spamcop.net>
Sender: Tod McQuillin <devin@distalzou.net>
Reply-To: Tod McQuillin <devin@spamcop.net>
To: FreeBSD-gnats-submit@freebsd.org
Cc: mav@freebsd.org
Subject: dsp.c returning from system call with Giant lock held after r203860
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         145081
>Category:       kern
>Synopsis:       dsp.c returning from system call with Giant lock held after r203860
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    mav
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 27 15:20:01 UTC 2010
>Closed-Date:    Wed Mar 31 08:06:53 UTC 2010
>Last-Modified:  Wed Mar 31 08:10:06 UTC 2010
>Originator:     Tod McQuillin
>Release:        FreeBSD 8.0-STABLE i386
>Organization:
Haphazard
>Environment:
System: FreeBSD reizouko.pun-pun.prv 8.0-STABLE FreeBSD 8.0-STABLE #1 r205666M: Sat Mar 27 23:05:26 JST 2010     devin@reizouko.pun-pun.prv:/usr/obj/usr/src.svn/sys/REIZOUKO  i386

System hardware: IBM Thinkpad X20

>Description:

When unplugging the machine from the AC adaptor, within a few seconds
the system freezes up.  This occurs when GNOME/x11 is running but not in
single user mode.

No messages are logged on the console, but when booting a kernel with
INVARIANTS and WITNESS enabled, the following panic is observed:

System call ioctl returning with the following locks held:
exclusive sleep mutex Giant (Giant) r = 0 (0xc0aafd50) locked @ /usr/src/sys/dev/sound/pcm/dsp.c:1064
panic: witness_warn
KDB: enter: panic
[thread pid 1087 tid 100149 ]
Stopped at      kdb_enter+0x3a: movl    $0,kdb_why

Investigation with KDB shows:
db> where
Tracing pid 1807 tid 100149 td 0xc448c6f0
kdb_enter(c09e9971,c09e9971,c09c08e3,cf840c54,cf840c54,...) at kdb_enter+0x3a
panic(c09c08e3,c099f329,0,0,0,...) at panic_0xd1
witness_warn(2,0,c0a21845,c0a0127d,c2c522a8,...) at witness_warn+0x1e9
syscall(cf840d38) at syscall+0x2d8
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (0, FreeBSD ELF32, nosys) eip = 0x294c5873, esp = 0xbf9fcd4c, ebp = 0xbf9fcd88 ---
exclusive sleep mutex Giant (Giant) r = 0 (0xc0aafd50) locked @ /usr/src/sys/dev/sound/pcm/dsp.c:1064
db> show pcpu
cpuid        = 0
dynamic pcpu    = 0x58eb00
curthread    = 0xc448c6f0: pid 1807 "gnome-power-manager"
curpcb       = 0xcf840d90
fpcurthread  = none
idlethread   = 0xc286c940: pid 11 "idle"
APIC ID      = 0
currentldt   = 0x50
spin locks held:

>How-To-Repeat:

Run GNOME on FreeBSD 8.0-STABLE (after SVN r203860) with
gnome-power-manager on an IBM Thinkpad X20.  Unplug the AC adaptor.  The
system will lock up within 3-7 seconds.

The problem seems to have been introduced with SVN r203860.

>Fix:

The following patch corrects the problem on my test system:

Index: sys/dev/sound/pcm/dsp.c
===================================================================
--- sys/dev/sound/pcm/dsp.c	(revision 205666)
+++ sys/dev/sound/pcm/dsp.c	(working copy)
@@ -1071,6 +1071,7 @@
 	if (IOCGROUP(cmd) == 'M') {
 		if (cmd == OSS_GETVERSION) {
 			*arg_i = SOUND_VERSION;
+			PCM_GIANT_EXIT(d);
 			return (0);
 		}
 		ret = dsp_ioctl_channel(i_dev, PCM_VOLCH(i_dev), cmd, arg);
>Release-Note:
>Audit-Trail:

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/145081: commit references a PR
Date: Sat, 27 Mar 2010 15:39:33 +0000 (UTC)

 Author: mav
 Date: Sat Mar 27 15:39:19 2010
 New Revision: 205734
 URL: http://svn.freebsd.org/changeset/base/205734
 
 Log:
   Fix lock leakage.
   
   PR:		kern/145081
 
 Modified:
   head/sys/dev/sound/pcm/dsp.c
 
 Modified: head/sys/dev/sound/pcm/dsp.c
 ==============================================================================
 --- head/sys/dev/sound/pcm/dsp.c	Sat Mar 27 15:05:06 2010	(r205733)
 +++ head/sys/dev/sound/pcm/dsp.c	Sat Mar 27 15:39:19 2010	(r205734)
 @@ -1071,6 +1071,7 @@ dsp_ioctl(struct cdev *i_dev, u_long cmd
  	if (IOCGROUP(cmd) == 'M') {
  		if (cmd == OSS_GETVERSION) {
  			*arg_i = SOUND_VERSION;
 +			PCM_GIANT_EXIT(d);
  			return (0);
  		}
  		ret = dsp_ioctl_channel(i_dev, PCM_VOLCH(i_dev), cmd, arg);
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: mav 
State-Changed-When: Sat Mar 27 15:40:11 UTC 2010 
State-Changed-Why:  
Patch committed to HEAD. 


Responsible-Changed-From-To: freebsd-bugs->mav 
Responsible-Changed-By: mav 
Responsible-Changed-When: Sat Mar 27 15:40:11 UTC 2010 
Responsible-Changed-Why:  
Patch committed to HEAD. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=145081 
State-Changed-From-To: patched->closed 
State-Changed-By: mav 
State-Changed-When: Wed Mar 31 08:06:32 UTC 2010 
State-Changed-Why:  
Patch merged to 8-STABLE. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=145081 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/145081: commit references a PR
Date: Wed, 31 Mar 2010 08:04:04 +0000 (UTC)

 Author: mav
 Date: Wed Mar 31 08:03:49 2010
 New Revision: 205972
 URL: http://svn.freebsd.org/changeset/base/205972
 
 Log:
   MFC r205734:
   Fix lock leakage.
   
   PR:             kern/145081
 
 Modified:
   stable/8/sys/dev/sound/pcm/dsp.c
 Directory Properties:
   stable/8/sys/   (props changed)
   stable/8/sys/amd64/include/xen/   (props changed)
   stable/8/sys/cddl/contrib/opensolaris/   (props changed)
   stable/8/sys/contrib/dev/acpica/   (props changed)
   stable/8/sys/contrib/pf/   (props changed)
   stable/8/sys/dev/xen/xenpci/   (props changed)
 
 Modified: stable/8/sys/dev/sound/pcm/dsp.c
 ==============================================================================
 --- stable/8/sys/dev/sound/pcm/dsp.c	Wed Mar 31 08:02:16 2010	(r205971)
 +++ stable/8/sys/dev/sound/pcm/dsp.c	Wed Mar 31 08:03:49 2010	(r205972)
 @@ -1071,6 +1071,7 @@ dsp_ioctl(struct cdev *i_dev, u_long cmd
  	if (IOCGROUP(cmd) == 'M') {
  		if (cmd == OSS_GETVERSION) {
  			*arg_i = SOUND_VERSION;
 +			PCM_GIANT_EXIT(d);
  			return (0);
  		}
  		ret = dsp_ioctl_channel(i_dev, PCM_VOLCH(i_dev), cmd, arg);
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
>Unformatted:
