Bug 279839 - panic: bogus vchan_create
Summary: panic: bogus vchan_create
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2024-06-18 21:01 UTC by Dave Cottlehuber
Modified: 2024-06-26 13:11 UTC (History)
2 users (show)

See Also:


Attachments
loader.conf (700 bytes, text/plain)
2024-06-25 14:56 UTC, Dave Cottlehuber
no flags Details
live sysctls (977 bytes, text/plain)
2024-06-25 14:58 UTC, Dave Cottlehuber
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dave Cottlehuber freebsd_committer freebsd_triage 2024-06-18 21:01:56 UTC
__curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
57              __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct pcpu,
(kgdb) #0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
#1  doadump (textdump=textdump@entry=0)
    at /usr/src/sys/kern/kern_shutdown.c:404
#2  0xffffffff8049d11a in db_dump (dummy=<optimized out>,
    dummy2=<optimized out>, dummy3=<optimized out>, dummy4=<optimized out>)
    at /usr/src/sys/ddb/db_command.c:595
#3  0xffffffff8049cf1d in db_command (last_cmdp=<optimized out>,
    cmd_table=<optimized out>, dopager=false)
    at /usr/src/sys/ddb/db_command.c:508
#4  0xffffffff8049d066 in db_command_script (
    command=command@entry=0xffffffff819c2764 <db_recursion_data+84> "dump")
    at /usr/src/sys/ddb/db_command.c:573
#5  0xffffffff804a2f18 in db_script_exec (
    scriptname=scriptname@entry=0xfffffe02e43ba5d0 "kdb.enter.panic",
    warnifnotfound=warnifnotfound@entry=0) at /usr/src/sys/ddb/db_script.c:301
#6  0xffffffff804a2e12 in db_script_kdbenter (eventname=<optimized out>)
    at /usr/src/sys/ddb/db_script.c:323
#7  0xffffffff804a0691 in db_trap (type=<optimized out>, code=<optimized out>)
    at /usr/src/sys/ddb/db_main.c:266
#8  0xffffffff80b94ebf in kdb_trap (type=type@entry=3, code=code@entry=0,
    tf=tf@entry=0xfffffe02e43ba910) at /usr/src/sys/kern/subr_kdb.c:790
#9  0xffffffff810632c9 in trap (frame=0xfffffe02e43ba910)
    at /usr/src/sys/amd64/amd64/trap.c:606
#10 <signal handler called>
#11 kdb_enter (why=<optimized out>, msg=<optimized out>)
    at /usr/src/sys/kern/subr_kdb.c:556
#12 0xffffffff80b455f0 in vpanic (
    fmt=0xffffffff811ffaa0 "bogus vchan_create() request newcnt=%d vcnt=%d",
    ap=ap@entry=0xfffffe02e43bab40) at /usr/src/sys/kern/kern_shutdown.c:967
#13 0xffffffff80b45473 in panic (
    fmt=0xffffffff81b89480 <cnputs_mtx> "yQ\024\201\377\377\377\377")
    at /usr/src/sys/kern/kern_shutdown.c:892
#14 0xffffffff808dce6f in vchan_setnew (d=<optimized out>, direction=1,
    newcnt=4) at /usr/src/sys/dev/sound/pcm/vchan.c:966
#15 0xffffffff808dd408 in sysctl_dev_pcm_vchans (oidp=0xfffff80105faca00,
    arg1=<optimized out>, arg2=<optimized out>, req=0xfffffe02e43bacc0)
    at /usr/src/sys/dev/sound/pcm/vchan.c:346
#16 0xffffffff80b5776c in sysctl_root_handler_locked (
    oid=oid@entry=0xfffff80105faca00, arg1=arg1@entry=0x9, arg2=arg2@entry=8,
    req=req@entry=0xfffffe02e43bacc0, tracker=tracker@entry=0xfffffe02e43bac40)
    at /usr/src/sys/kern/kern_sysctl.c:199
#17 0xffffffff80b56b0e in sysctl_root (oidp=<optimized out>, arg1=0x9,
    arg1@entry=0xfffffe02e43bad80, arg2=8, arg2@entry=5,
    req=req@entry=0xfffffe02e43bacc0) at /usr/src/sys/kern/kern_sysctl.c:2405
#18 0xffffffff80b571ca in userland_sysctl (td=td@entry=0xfffff802a1fb6000,
    name=name@entry=0xfffffe02e43bad80, namelen=<optimized out>,
    old=<optimized out>, oldlenp=<optimized out>, inkernel=inkernel@entry=0,
    new=0x42a963808008, newlen=4, retval=0xfffffe02e43bade8, flags=0)
    at /usr/src/sys/kern/kern_sysctl.c:2562
#19 0xffffffff80b57010 in sys___sysctl (td=0xfffff802a1fb6000,
    uap=0xfffff802a1fb6400) at /usr/src/sys/kern/kern_sysctl.c:2435
#20 0xffffffff810646d8 in syscallenter (td=0xfffff802a1fb6000)
    at /usr/src/sys/amd64/amd64/../../kern/subr_syscall.c:189
#21 amd64_syscall (td=0xfffff802a1fb6000, traced=0)
    at /usr/src/sys/amd64/amd64/trap.c:1192
#22 <signal handler called>
#23 0x0000295a9ff7809a in ?? ()
Backtrace stopped: Cannot access memory at address 0x295a9e6440c8
(kgdb)
(END)

had to unplug USB audio device to be able to boot, otherwise its repeated crash on restart

- current built off 914c2b3314e8f6e31833e33cfdcc4843f88fe31b (June 18)
- but seen since d9ab8999313845e87c67532437a0441d9cd57e72 (June 7)
Comment 1 Dave Cottlehuber freebsd_committer freebsd_triage 2024-06-18 22:20:16 UTC
after a bit more experimenting, this sysctl is what causes problems:

# dev.pcm.1.play.vchans=4

rebooting without that is fine, here are settings:

# cat /dev/sndstat
FreeBSD Audio Driver
Installed devices:
pcm0: <C-Media Electronics Inc. M-AUDIO Uber Mic> on uaudio0 (1p:1v/1r:1v)
        snddev flags=0x2e2<AUTOVCHAN,BUSY,MPSAFE,REGISTERED,VPC>
        [pcm0:play:dsp0.p0]: spd 48000, fmt 0x00200010, flags 0x00002100, 0x00000004
        interrupts 216, underruns 0, feed 215, ready 0 [b:1536/768/2|bs:2048/1024/2]
        channel flags=0x2100<BUSY,HAS_VCHAN>
        {userland} -> feeder_mixer(0x00200010) -> {hardware}
        pcm0:play:dsp0.p0[pcm0:virtual_play:dsp0.vp0]: spd 48000, fmt 0x00200010, flags 0x10000000, 0x00000021
        interrupts 0, underruns 0, feed 0, ready 0 [b:0/0/0|bs:8192/1024/8]
        channel flags=0x10000000<VIRTUAL>
        {userland} -> feeder_root(0x00200010) -> feeder_volume(0x00200010) -> {hardware}
        [pcm0:record:dsp0.r0]: spd 48000, fmt 0x00200010, flags 0x00002100, 0x00000005
        interrupts 0, overruns 0, feed 0, hfree 1536, sfree 2048 [b:1536/768/2|bs:2048/1024/2]
        channel flags=0x2100<BUSY,HAS_VCHAN>
        {hardware} -> feeder_root(0x00200010) -> feeder_mixer(0x00200010) -> {userland}
        pcm0:record:dsp0.r0[pcm0:virtual_record:dsp0.vr0]: spd 8000, fmt 0x00100008, flags 0x10000000, 0x00000000
        interrupts 0, overruns 0, feed 0, hfree 0, sfree 0 [b:0/0/0|bs:0/0/0]
        channel flags=0x10000000<VIRTUAL>
        {hardware} -> feeder_root(0x00000000) -> {userland}
pcm1: <Chord Electronics Ltd Mojo> on uaudio1 (1p:1v/0r:0v) default
        snddev flags=0x200002e3<SIMPLEX,AUTOVCHAN,BUSY,MPSAFE,REGISTERED,VPC,PRIO_WR>
        [pcm1:play:dsp1.p0]: spd 48000, fmt 0x00200010/0x00201000, flags 0x00002100, 0x00000006
        interrupts 864, underruns 0, feed 863, ready 0 [b:3072/1536/2|bs:2048/1024/2]
        channel flags=0x2100<BUSY,HAS_VCHAN>
        {userland} -> feeder_mixer(0x00200010) -> feeder_format(0x00200010 -> 0x00201000) -> {hardware}
        pcm1:play:dsp1.p0[pcm1:virtual_play:dsp1.vp0]: spd 48000, fmt 0x00200010, flags 0x10000000, 0x00000021
        interrupts 0, underruns 0, feed 0, ready 0 [b:0/0/0|bs:8192/1024/8]
        channel flags=0x10000000<VIRTUAL>
        {userland} -> feeder_root(0x00200010) -> feeder_volume(0x00200010) -> {hardware}
No devices installed from userspace.

# sysctl -a dev.pcm.1
dev.pcm.1.feedback_rate: 47998
dev.pcm.1.mixer.mute_1.desc:
dev.pcm.1.mixer.mute_1.max: 1
dev.pcm.1.mixer.mute_1.min: 0
dev.pcm.1.mixer.mute_1.val: 0
dev.pcm.1.mixer.vol_0.desc:
dev.pcm.1.mixer.vol_0.max: 0
dev.pcm.1.mixer.vol_0.min: -32767
dev.pcm.1.mixer.vol_0.val: -14418
dev.pcm.1.mode: 3
dev.pcm.1.bitperfect: 0
dev.pcm.1.buffersize: 0
dev.pcm.1.play.vchanformat: s16le:2.0
dev.pcm.1.play.vchanrate: 48000
dev.pcm.1.play.vchanmode: fixed
dev.pcm.1.play.vchans: 1
dev.pcm.1.hwvol_mixer: vol
dev.pcm.1.hwvol_step: 5
dev.pcm.1.%parent: uaudio1
dev.pcm.1.%pnpinfo:
dev.pcm.1.%location:
dev.pcm.1.%driver: pcm
dev.pcm.1.%desc: Chord Electronics Ltd Mojo
Comment 2 Christos Margiolis freebsd_committer freebsd_triage 2024-06-19 13:47:36 UTC
I am trying to reproduce this with my USB soundcard by setting the play vchans from 1 to 4, but I don't hit the same problem. Apparently you are hitting the KASSERT in vchan_setnew(). It would be very helpful to see what KASSERT prints (i.e what the values of newcnt and vcnt are).

Can you also share your /boot/loader.conf, hw.snd and hw.usb.uaudio?
Comment 3 Dave Cottlehuber freebsd_committer freebsd_triage 2024-06-25 14:56:47 UTC
Created attachment 251692 [details]
loader.conf
Comment 4 Dave Cottlehuber freebsd_committer freebsd_triage 2024-06-25 14:58:29 UTC
Created attachment 251693 [details]
live sysctls

also, sysctl.conf sets

hw.snd.verbose=2
hw.snd.basename_clone=1
hw.snd.default_auto=1
hw.snd.default_unit=1
hw.snd.maxautovchans=8
Comment 5 Christos Margiolis freebsd_committer freebsd_triage 2024-06-26 13:11:18 UTC
Everything seems reasonable. I still cannot reproduce this even with the same sysctl values as yours. Can you make sure sound(4) is recompiled properly?