From zach@uffdaonline.net  Sun Mar  4 02:47:41 2001
Return-Path: <zach@uffdaonline.net>
Received: from uffdaonline.net (host34.uffdaonline.net [207.109.235.34])
	by hub.freebsd.org (Postfix) with ESMTP id 8A71E37B718
	for <FreeBSD-gnats-submit@freebsd.org>; Sun,  4 Mar 2001 02:47:40 -0800 (PST)
	(envelope-from zach@uffdaonline.net)
Received: by uffdaonline.net (Postfix, from userid 1000)
	id 3F65AA7B; Sun,  4 Mar 2001 04:47:42 -0600 (CST)
Message-Id: <20010304104742.3F65AA7B@uffdaonline.net>
Date: Sun,  4 Mar 2001 04:47:42 -0600 (CST)
From: zach@uffdaonline.net
Reply-To: zach@uffdaonline.net
To: FreeBSD-gnats-submit@freebsd.org
Subject: -STABLE crash from ordinary user (newpcm related)
X-Send-Pr-Version: 3.2

>Number:         25519
>Category:       kern
>Synopsis:       -STABLE crash from ordinary user (newpcm related)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    cg
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Mar 04 02:50:01 PST 2001
>Closed-Date:    Mon Mar 26 21:55:22 PST 2001
>Last-Modified:  Mon Mar 26 21:56:45 PST 2001
>Originator:     Zach N. Heilig
>Release:        FreeBSD 4.2-STABLE i386
>Organization:
none
>Environment:

>Description:

simply:

panic: page fault

(that's the only message after the current time from /etc/rc and before
 'synching disks...')

>How-To-Repeat:

compile and run this code (as any user that has read/write access to the
sound driver):

--- snip ---
#include <machine/soundcard.h>

#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

void fast_writer(void);
void slow_reader(void);

void wakeup(int s) { }

int
main(void)
{
  sigset_t none;
  int child;

  child = fork();
  if (child == 0)
    fast_writer();

  /* let the writer set up the channel properly... */
  signal(SIGUSR1, wakeup);
  sigemptyset(&none);
  sigsuspend(&none);

  /* and let it get a bit ahead... */
  sleep(5);
  
  slow_reader();

  return 0;
}


void
fast_writer(void)
{
  int parent;
  int fd;
  int format = AFMT_S16_LE;
  int speed =  44100;
  int bits = 16;
  int stereo = 1;
  char out[17640];

  parent = getppid();
  memset(out, 0, sizeof out);

  fprintf(stderr, "pid %d\n", getpid());
  fd = open("/dev/dsp", O_WRONLY);
  if (fd == -1) {
    perror("fast_writer: unable to open /dev/dsp");
    kill(parent, SIGUSR1);
    exit(1);
  }

  ioctl(fd, SNDCTL_DSP_SETFMT, &format);
  ioctl(fd, SNDCTL_DSP_SPEED, &speed);
  ioctl(fd, SNDCTL_DSP_SAMPLESIZE, &bits);
  ioctl(fd, SNDCTL_DSP_STEREO, &stereo);

  fprintf(stderr, "fast_writer: starting loop\n");

  kill(parent, SIGUSR1);
  while (1) {
    write(fd, out, sizeof out);
    write(STDOUT_FILENO, ">", 1);
  }
}


void
slow_reader(void)
{
  int cnt;
  int fd;
  int in[1600];

  fprintf(stderr, "pid %d\n", getpid());
  open("/dev/dspW", O_WRONLY);
  fd = open("/dev/dspW", O_RDONLY);
  if (fd == -1) {
    perror("slow_reader: unable to open /dev/dsp");
    exit(1);
  }

  fprintf(stderr, "slow_reader: starting loop\n");

  for (cnt = 0; cnt < 10; ++cnt) {
    read(fd, in, sizeof in);
    write(STDOUT_FILENO, "<", 1);
  }

  exit(0);
}
--- snip ---

>Fix:
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: kris 
State-Changed-When: Mon Mar 12 18:24:15 PST 2001 
State-Changed-Why:  
Problem may already be resolved 


Responsible-Changed-From-To: freebsd-bugs->cg 
Responsible-Changed-By: kris 
Responsible-Changed-When: Mon Mar 12 18:24:15 PST 2001 
Responsible-Changed-Why:  
cg is Mr Sound 

http://www.freebsd.org/cgi/query-pr.cgi?pr=25519 
State-Changed-From-To: feedback->closed 
State-Changed-By: cg 
State-Changed-When: Mon Mar 26 21:55:22 PST 2001 
State-Changed-Why:  
fixed in -stable and -current 

http://www.freebsd.org/cgi/query-pr.cgi?pr=25519 
>Unformatted:
