[patch] calling mss_unlock() twice (causes kernel panic)

[Watanabe Kazuhiro]

Hi, everyone.

I have an AOpen AW37Pro soundcard which uses the Crystal CX4235
soundchip.

When I try to record on FreeBSD-7-current/i386 (CVSup'ed Nov. 5) with
wavrec (a part of ports/audio/wavplay), it causes kernel panic.

panic: lock (sleep mutex) pcm2 not locked @ /FreeBSD/FreeBSD-current/src/sys/modules/sound/driver/mss/../../../../dev/sound/isa/mss.c:189
cpuid = 0
KDB: enter: panic
[thread pid 30 tid 100035 ]
Stopped at      kdb_enter+0x2b: nop     
db> trace
Tracing pid 30 tid 100035 td 0xc21b4480
kdb_enter(c086b04b) at kdb_enter+0x2b
panic(c086f5f4,c0886f8e,c22d9860,c0acc397,bd) at panic+0x127
witness_unlock(c22ef4c0,8,c0acc397,bd) at witness_unlock+0xc0
_mtx_unlock_flags(c22ef4c0,0,c0acc397,bd,cbfefcd4) at _mtx_unlock_flags+0x5b
mss_unlock(c231bd80,20983d18,c22ef440,c21cd880,0) at mss_unlock+0x17
mss_intr(c2318b00) at mss_intr+0x129
ithread_execute_handlers(c22e8000,c21cd880) at ithread_execute_handlers+0xe6
ithread_loop(c22d9940,cbfefd38,c22d9940,c062cefc,0) at ithread_loop+0x67
fork_exit(c062cefc,c22d9940,cbfefd38) at fork_exit+0xa4
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xcbfefd6c, ebp = 0 ---
db>

 * Environment

$ uname -a
FreeBSD scorpio.zodiac.org 7.0-CURRENT FreeBSD 7.0-CURRENT #3: Sat Nov  5 17:23:54 JST 2005     nabe at scorpio.zodiac.org:/FreeBSD/obj-current/FreeBSD/FreeBSD-current/src/sys/GENERIC  i386
$ cat /dev/sndstat
FreeBSD Audio Driver (newpcm)
Installed devices:
pcm0: <Avance Logic ALS4000> at io 0xe800 irq 9 kld snd_als4000 (1p/1r/0v channels duplex default)
pcm1: <SB16 DSP 4.13> at io 0x240 irq 5 drq 1:5 bufsz 4096d kld snd_sb16 (1p/1r/0v channels duplex)
pcm2: <CS423x> at io 0x534 irq 10 drq 3:0 bufsz 4096 (1p/1r/0v channels duplex)


It's a fix patch.

--- sys/dev/sound/isa/mss.c.orig	Mon Sep 12 22:40:10 2005
+++ sys/dev/sound/isa/mss.c	Sun Nov  6 20:20:56 2005
@@ -807,7 +807,7 @@ mss_intr(void *arg)
 	    		served |= 0x20;
 			mss_unlock(mss);
 	    		chn_intr(mss->rch.channel);
-			mss_unlock(mss);
+			mss_lock(mss);
 		}
 		/* now ack the interrupt */
 		if (FULL_DUPLEX(mss)) ad_write(mss, 24, ~c); /* ack selectively */

---
Watanabe Kazuhiro (CQG00620 at nifty.ne.jp)
# PCTel HSP MicroModem driver for FreeBSD
# http://homepage2.nifty.com/dumb_show/unix/