From owner-freebsd-bugs  Mon Mar  5  1:24:12 2001
Delivered-To: freebsd-bugs@freebsd.org
Received: from uffdaonline.net (host37.uffdaonline.net [207.109.235.37])
	by hub.freebsd.org (Postfix) with ESMTP
	id 9179737B719; Mon,  5 Mar 2001 01:24:05 -0800 (PST)
	(envelope-from zach@uffdaonline.net)
Received: by uffdaonline.net (Postfix, from userid 1000)
	id 92FEEA7E; Mon,  5 Mar 2001 03:23:09 -0600 (CST)
Date: Mon, 5 Mar 2001 03:23:09 -0600
From: "Zach N. Heilig" <zach@uffdaonline.net>
To: gnats-admin@FreeBSD.org, freebsd-bugs@FreeBSD.org
Subject: Re: kern/25519: -STABLE crash from ordinary user (newpcm related)
Message-ID: <20010305032309.A22753@murkwood.znh.org>
References: <20010304104742.3F65AA7B@uffdaonline.net> <200103041050.f24Ao1r81678@freefall.freebsd.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <200103041050.f24Ao1r81678@freefall.freebsd.org>; from gnats-admin@FreeBSD.org on Sun, Mar 04, 2001 at 02:50:01AM -0800
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Hm.. it was late when I wrote the bit of code to trigger this crash.
Here is a far far simpler version that crashes 100% of the time for me
(on two separate machines, with any user):

(kernel from sometime on Feb 24th -- but I've observed this periodically
 over the past few months -- I just haven't tracked it down until now)

#include <machine/soundcard.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
int
main(void)
{
  int fd;
  int format = AFMT_S16_LE;
  int speed =  44100;
  int bits = 16;
  int stereo = 1;
  char out[17640];

  memset(out, 0, sizeof out);

  fd = open("/dev/dsp", O_WRONLY);
  if (fd == -1) {
    perror("unable to open /dev/dsp");
    exit(1);
  }

  ioctl(fd, SNDCTL_DSP_SETFMT, &format);
  ioctl(fd, SNDCTL_DSP_SPEED, &speed);
  ioctl(fd, SNDCTL_DSP_SAMPLESIZE, &bits);
  ioctl(fd, SNDCTL_DSP_STEREO, &stereo);

  write(fd, out, sizeof out);
  close(open("/dev/dspW", O_RDONLY));
  write(fd, out, sizeof out);

  return 0;
}

it can also be produced by simply typing:

$ < /dev/dspW

while playing audio (mp3, game with audio, whatever).  It won't crash
1) if the read channel is kept open (the output audio will just be severly
   distorted) 
2) if the write channel is closed first.


Machine #1:

Copyright (c) 1992-2001 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 4.2-STABLE #0: Sat Feb 24 05:31:05 CST 2001
    zach@murkwood:/usr/obj/usr/src/sys/MURKWOOD
Timecounter "i8254"  frequency 1193202 Hz
CPU: AMD-K6tm w/ multimedia extensions (300.69-MHz 586-class CPU)
  Origin = "AuthenticAMD"  Id = 0x570  Stepping = 0
  Features=0x8001bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8,MMX>
  AMD Features=0x400<<b10>>
real memory  = 134217728 (131072K bytes)
avail memory = 126423040 (123460K bytes)
...
pcm0: <AudioPCI ES1370> port 0xe000-0xe03f irq 11 at device 9.0 on pci0
...

Machine #2

Copyright (c) 1992-2001 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD 4.2-STABLE #1: Sat Feb 24 16:32:27 CST 2001
    zach@mp3:/usr/obj/usr/src/sys/MP3S4
Timecounter "i8254"  frequency 1193182 Hz
CPU: Cyrix MediaGX (486-class CPU)
  Origin = "CyrixInstead"  DIR=0x2241  Stepping=2  Revision=2
real memory  = 31326208 (30592K bytes)
avail memory = 27226112 (26588K bytes)
...
sbc0: <SoundBlaster 16> at port 0x220-0x22f irq 5 drq 1 flags 0x15 on isa0
pcm1: <SB16 DSP 4.12> on sbc0
...

-- 
Zach Heilig <zach@uffdaonline.net>

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message