From owner-freebsd-current@FreeBSD.ORG  Wed Jan 28 23:14:55 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 06E7516A4CE; Wed, 28 Jan 2004 23:14:55 -0800 (PST)
Received: from gw.catspoiler.org (217-ip-163.nccn.net [209.79.217.163])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id BEA9543D3F; Wed, 28 Jan 2004 23:14:49 -0800 (PST)
	(envelope-from truckman@FreeBSD.org)
Received: from FreeBSD.org (mousie.catspoiler.org [192.168.101.2])
	by gw.catspoiler.org (8.12.9p2/8.12.9) with ESMTP id i0T7EY7E085897;
	Wed, 28 Jan 2004 23:14:38 -0800 (PST)
	(envelope-from truckman@FreeBSD.org)
Message-Id: <200401290714.i0T7EY7E085897@gw.catspoiler.org>
Date: Wed, 28 Jan 2004 23:14:34 -0800 (PST)
From: Don Lewis <truckman@FreeBSD.org>
To: emoe@cox.net
In-Reply-To: <IJEJIDFLPIJEPPAPEIHCCEDBCEAA.emoe@cox.net>
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
cc: freebsd-current@FreeBSD.org
cc: jhb@FreeBSD.org
Subject: Re: 5.2-RELEASE panic in turnstile_wait
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Jan 2004 07:14:55 -0000

On 29 Jan, Erik Moe wrote:
> My loader.conf looks like this...
> 
> hw.pci.allow_unsupported_io_range="1"
> hw.ata.atapi_dma="1"
> 
> hw.snd.pcm0.vchans=4
> hw.snd.maxautovchans=4

There is a potential buffer overflow in the vchan code that can bzero()
unrelated objects in the kernel heap, like the mutex that you found, and
cause hard to track down system panics.  The buffer overflow can be
triggered by certain combinations of sound hardware and software.

The 5.2-RELEASE errata list contains the following note:

(9 Jan 2004) The use of multiple vchans (virtual audio channels with
dynamic mixing in software) in the pcm(4) driver has been known to cause
some instability.


I finally came up with a fix for this problem that worked and checked it
into the -CURRENT source within the last 24 hours.  I'd recommend either
disabling vchans or upgrading to -CURRENT, though you might be able to
retrofit the contents of src/sys/dev/sound/pcm/ and rebuild your kernel.