port-mac68k/60720: mac68k: ascaudio(4) takes its interrupt before initialising the lock the handler enters

["raytran08%gmail.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60720
>Category:       port-mac68k
>Synopsis:       mac68k: ascaudio(4) takes its interrupt before initialising the lock the handler enters
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    port-mac68k-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 11 23:25:00 +0000 2026
>Originator:     Ray Tran
>Release:        11.0
>Organization:
Diamond Creek Digital
>Environment:
Hardware: Apple Macintosh Centris 650
Kernel: NetBSD 11.0 and CURRENT
>Description:
ascaudioattach() registers the interrupt handler and enables the
interrupt, and only then initialises sc_lock, sc_intr_lock and the two
callouts.  ascaudio_intr() enters sc_intr_lock, so during that window a
sound interrupt would take an uninitialised mutex.

Today the code is unreachable: the chip is in MODESTOP so its own interrupt
is quiet, and the handler returns early while no transfer is active.
That is luck rather than design.  The VIA2 mirror interrupt described in
port-mac68k/60701 arrives on this line on the Centris and Quadra 650
regardless of the chip's state, and any future change that touches the
chip or the lock in the handler before the early return would find the
window.  The convention throughout the tree is that a handler's locks
exist before the handler can run.
>How-To-Repeat:
By inspection: sys/arch/mac68k/obio/ascaudio.c, ascaudioattach(), the
intr_establish()/via2_register_irq() and ascaudio_intr_enable() calls
precede mutex_init() and callout_init().
>Fix:
pplies to sys/arch/mac68k/obio/ascaudio.c.  It is independent of
port-mac68k/60701 and 60702, which change other parts of the file.
The patched driver builds under NetBSD 11.0.  The same patch applies to
-current.


Applies with "patch -p1" from the top of usr/src; verified with -F0
(no fuzz) against NetBSD-current 11.99.8 (20260830003849Z) and 11.0.

--- a/sys/arch/mac68k/obio/ascaudio.c
+++ b/sys/arch/mac68k/obio/ascaudio.c
@@ -273,13 +273,6 @@
 
 	bus_space_write_1(sc->sc_tag, sc->sc_handle, ASCMODE, MODESTOP);
 
-	if (mac68k_machine.aux_interrupts) {
-		intr_establish(ascaudio_intr_est, sc, ASCIRQ);
-	} else {
-		via2_register_irq(VIA2_ASC, ascaudio_intr, sc);
-	}
-	ascaudio_intr_enable();
-
 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NONE);
 	mutex_init(&sc->sc_intr_lock, MUTEX_DEFAULT, IPL_AUDIO);
 	callout_init(&sc->sc_pcallout, CALLOUT_MPSAFE);
@@ -287,6 +280,14 @@
 	callout_init(&sc->sc_rcallout, CALLOUT_MPSAFE);
 	callout_setfunc(&sc->sc_rcallout, ascaudio_done_input, sc);
 
+	/* The handler takes sc_intr_lock, so it goes live only now. */
+	if (mac68k_machine.aux_interrupts) {
+		intr_establish(ascaudio_intr_est, sc, ASCIRQ);
+	} else {
+		via2_register_irq(VIA2_ASC, ascaudio_intr, sc);
+	}
+	ascaudio_intr_enable();
+
 	sc->sc_vol = 180;
 	sc->sc_recvol = 255;