kern/55848: amd64 9/99.76 panic in audio(4)

[paul%whooppee.com@localhost]

>Number:         55848
>Category:       kern
>Synopsis:       amd64 9/99.76 panic in audio(4)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Dec 07 16:45:00 +0000 2020
>Originator:     Paul Goyette
>Release:        NetBSD 9.99.76
>Organization:
+--------------------+--------------------------+-----------------------+
| Paul Goyette       | PGP Key fingerprint:     | E-mail addresses:     |
| (Retired)          | FA29 0E3B 35AF E8AE 6651 | paul%whooppee.com@localhost     |
| Software Developer | 0786 F758 55DE 53BA 7731 | pgoyette%netbsd.org@localhost   |
+--------------------+--------------------------+-----------------------+
>Environment:
	
	
System: NetBSD speedy.whooppee.com 9.99.76 NetBSD 9.99.76 (SPEEDY 2020-12-04 23:39:34 UTC) #0: Sat Dec 5 07:30:37 UTC 2020 paul%speedy.whooppee.com@localhost:/build/netbsd-local/obj/amd64/sys/arch/amd64/compile/SPEEDY amd64
Architecture: x86_64
Machine: amd64
>Description:
	With amd64 9.99.76, if I create a shortage of kernel file
	table entries the audio driver panics during open(2).
	The symptom starts with thousands of the following error
	message within just a few seconds

[ 37907.1552432] file: table is full - increase kern.maxfiles or MAXFILES
[ 37907.1552432] file: table is full - increase kern.maxfiles or MAXFILES
[ 37907.1552432] file: table is full - increase kern.maxfiles or MAXFILES
...  (6,776 identical lines snipped)
[ 37928.6031590] file: table is full - increase kern.maxfiles or MAXFILES
[ 37928.6231664] file: table is full - increase kern.maxfiles or MAXFILES
[ 37928.6231664] file: table is full - increase kern.maxfiles or MAXFILES

	Then the system panics:

[ 37928.6231664] panic: kernel diagnostic assertion "sc->sc_rbusy == false" fail
ed: file "/build/netbsd-local/src_ro/sys/dev/audio/audio.c", line 5587
[ 37928.6231664] cpu1: Begin traceback...
[ 37928.6231664] vpanic() at netbsd:vpanic+0x156
[ 37928.6231664] __x86_indirect_thunk_rax() at netbsd:__x86_indirect_thunk_rax
[ 37928.6231664] audio_rmixer_start() at audio:audio_rmixer_start+0xe7
[ 37928.6231664] audio_open.isra.0() at audio:audio_open.isra.0+0x2ad
[ 37928.6231664] audioopen() at audio:audioopen+0x18f
[ 37928.6231664] spec_open() at netbsd:spec_open+0x176
[ 37928.6231664] VOP_OPEN() at netbsd:VOP_OPEN+0x3c
[ 37928.6231664] vn_open() at netbsd:vn_open+0x130
[ 37928.6231664] do_open() at netbsd:do_open+0x119
[ 37928.6231664] do_sys_openat() at netbsd:do_sys_openat+0x74 
[ 37928.6231664] sys_open() at netbsd:sys_open+0x24
[ 37928.6231664] syscall() at netbsd:syscall+0x23e
[ 37928.6231664] --- syscall (number 5) ---
[ 37928.6231664] netbsd:syscall+0x23e: 
[ 37928.6231664] cpu1: End traceback...
[ 37928.6231664] fatal breakpoint trap in supervisor mode
[ 37928.6231664] trap type 1 code 0 rip 0xffffffff8021f415 cs 0x8 rflags 0x202 c
r2 0x7c954ff98000 ilevel 0 rsp 0xffff8b892c18ca50
[ 37928.6231664] curlwp 0xffff81b1ff052b00 pid 1537.1538 lowest kstack 0xffff8b8
92c1882c0
Stopped in pid 1537.1538 (pulseaudio) at        netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
>How-To-Repeat:
	It's not 100% repeatable, but I have gotten this crash twice
	under the following conditions:

	1. Use sysctl to reduce kern.maxfiles 20000 --> 5120

	2. Run firefox, open up a lot of tabs, and switch to a tab
	   which has an audio stream

(Note that the reduction of kern.maxfiles was "an accident"!  It was
a left-over entry in /etc/sysctl.conf which was added a long time ago
when firefox used to exceed the default value of ~3k.  Recent changes
increased the default value - to 20000 on my system - so the entry in
sysctl.conf was a significant reduction/restriction!)
	
>Fix:
	No fix available
	

>Unformatted: