Re: kern/56164: System panicked: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)

[Andrius V <vezhlys%gmail.com@localhost>]

The following reply was made to PR kern/56164; it has been noted by GNATS.

From: Andrius V <vezhlys%gmail.com@localhost>
To: kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost, 
	nia%pkgsrc.org@localhost, gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c",
 line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
Date: Sat, 29 May 2021 00:23:53 +0300

 It seems that the problem may be caused by the race condition when
 file->dying is not yet set to true, but sc->sc_dying is already marked
 as true (probably by uaudio). Thus, this patch seems to fix my crash
 on jabra headset removal  (also mentioned in PR/56172 thread) and
 prevents from reaching psref_acquire, which causes assertion panic in
 subr_psref.c 296 or 299:
 
 diff --git a/sys/dev/audio/audio.c b/sys/dev/audio/audio.c
 index cb5eb00ccce..2e58457e58c 100644
 --- a/sys/dev/audio/audio.c
 +++ b/sys/dev/audio/audio.c
 @@ -1578,7 +1578,7 @@ audio_sc_acquire_fromfile(audio_file_t *file,
 struct psref *refp)
 
         /* If close or audiodetach already ran, tough -- no more audio */
         dying = atomic_load_relaxed(&file->dying);
 -       if (dying) {
 +       if (dying || file->sc->sc_dying) {
                 pserialize_read_exit(s);
                 return NULL;
 
         }
 
 On Tue, May 18, 2021 at 7:05 PM Andrius V <vezhlys%gmail.com@localhost> wrote:
 >
 > The following reply was made to PR kern/56164; it has been noted by GNATS.
 >
 > From: Andrius V <vezhlys%gmail.com@localhost>
 > To: gnats-bugs%netbsd.org@localhost
 > Cc: kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost,
 >         nia%pkgsrc.org@localhost
 > Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 >  "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c",
 >  line 296 mismatched psref target class: 0x0 (ref) != 0xffffd2ef411bc940 (expected)
 > Date: Tue, 18 May 2021 19:02:46 +0300
 >
 >  Yes, I had similar crash on headset removal, mentioned in
 >  port-amd64/56172 thread. I easily reproduce by removing my Jabra
 >  headset while sound plays on audiocfg test.
 >
 >  On Tue, May 18, 2021 at 4:20 PM nia <nia%netbsd.org@localhost> wrote:
 >  >
 >  > The following reply was made to PR kern/56164; it has been noted by GNATS.
 >  >
 >  > From: nia <nia%NetBSD.org@localhost>
 >  > To: gnats-bugs%netbsd.org@localhost
 >  > Cc:
 >  > Subject: Re: kern/56164: System panicked: kernel diagnostic assertion
 >  >  "(target->prt_class == class)" failed: file
 >  >  "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class:
 >  >  0x0 (ref) != 0xffffd2ef411bc940 (expected)
 >  > Date: Tue, 18 May 2021 13:17:12 +0000
 >  >
 >  >  Gah, it appears to be audio (possibly uaudio) related.
 >  >
 >  >  [  9180.811329] panic: kernel diagnostic assertion "(target->prt_class == class)" failed: file "/src/src/sys/kern/subr_psref.c", line 296 mismatched psref target class: 0x0 (ref) != 0xfffff76135d8a080 (expected)
 >  >  [  9180.811329] cpu2: Begin traceback...
 >  >  [  9180.821329] vpanic() at netbsd:vpanic+0x230
 >  >  [  9180.821329] db_print_address.cold() at netbsd:db_print_address.cold
 >  >  [  9180.821329] psref_acquire() at netbsd:psref_acquire+0x4e0
 >  >  [  9180.831327] audio_sc_acquire_fromfile() at netbsd:audio_sc_acquire_fromfile+0xc6
 >  >  [  9180.831327] audioclose() at netbsd:audioclose+0x136
 >  >  [  9180.841327] closef() at netbsd:closef+0x17f
 >  >  [  9180.841327] fd_free() at netbsd:fd_free+0x3c5
 >  >  [  9180.841327] exit1() at netbsd:exit1+0x301
 >  >  [  9180.851327] sys_exit() at netbsd:sys_exit+0xb0
 >  >  [  9180.851327] syscall() at netbsd:syscall+0x26b
 >  >  [  9180.861328] --- syscall (number 1) ---
 >  >  [  9180.861328] netbsd:syscall+0x26b:
 >  >  [  9180.861328] cpu2: End traceback...
 >  >
 >  >  Still don't have an intact dump, unfortunately...
 >  >
 >