Closing /dev/pad before closing /dev/audio causes panic.
It is filed as PR kern/54427. It can be reproduced with attached
sample code on -current and netbsd-9.
Would someone take look?
pad_close()
calls audiodetach() (via config_detach_children())
-> this detaches audio device (without closing descriptors).
then calls pad_detach()
-> this detaches pad device.
audioclose()
panics. Because it cannot acquire mutex (sc->sc_lock). This mutex
is provided by pad, and the pad has already been detached.
According to audio.c comment, vdevgone() calls close(). But it is
not called actually.
sys/dev/audio/audio.c
1224 audiodetach(device_t self, int flags)
1225 {
:
1257 /*
1258 * Nuke the vnodes for any open instances (calls close).
1259 * Will wait until any activity on the device nodes has ceased.
1260 */
1261 mn = device_unit(self);
1262 vdevgone(maj, mn | SOUND_DEVICE, mn | SOUND_DEVICE, VCHR);
1263 vdevgone(maj, mn | AUDIO_DEVICE, mn | AUDIO_DEVICE, VCHR);
1264 vdevgone(maj, mn | AUDIOCTL_DEVICE, mn | AUDIOCTL_DEVICE, VCHR);
1265 vdevgone(maj, mn | MIXER_DEVICE, mn | MIXER_DEVICE, VCHR);
# By the way, this panic didn't occur until merging isaki-audio2.
# Because previous audio driver aborted audioclose() without refering
# this destroyed mutex (that is, it had a resource leak). In result,
# you had never encountered this panic before.
Thanks,
---
Tetsuya Isaki <[email protected] / [email protected]>
#include <err.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
int main(int ac, char *av[])
{
const char *devaudio = "/dev/audio1"; /* set your device */
int fdpad;
int fdaudio;
int r;
fdpad = open("/dev/pad", O_RDONLY);
if (fdpad == -1)
err(1, "open: dev/pad");
fdaudio = open(devaudio, O_WRONLY);
if (fdaudio == -1)
err(1, "open: dev/audio");
close(fdpad);
close(fdaudio);
return 0;
}
