Project

General

Profile

Actions

Bug #3286

closed

page fault in dsp_kqfilter / knote_insert using snd_hda

Added by mwiencek 5 months ago. Updated 5 months ago.

Status:
Resolved
Priority:
High
Assignee:
Category:
-
Target version:
Start date:
06/26/2021
Due date:
% Done:

0%

Estimated time:

Description

I installed DragonFly on a motherboard from 2018 (GIGABYTE B450 AORUS PRO WIFI) and tested the sound to see if it worked. (Two HDA devices are detected, but one is from the GPU and I was only testing the output of the integrated one, hdac1.)

pciconf -lv, truncated

hdac0@pci0:6:0:1:    class=0x040300 card=0xaaf01849 chip=0xaaf01002 rev=0x00 hdr=0x00
    vendor     = 'Advanced Micro Devices, Inc. [AMD/ATI]'
    device     = 'Ellesmere HDMI Audio [Radeon RX 470/480 / 570/580/590]'
    class      = multimedia
    subclass   = HDA
hdac1@pci0:8:0:3:    class=0x040300 card=0xa0c31458 chip=0x14571022 rev=0x00 hdr=0x00
    vendor     = 'Advanced Micro Devices, Inc. [AMD]'
    device     = 'Family 17h (Models 00h-0fh) HD Audio Controller'
    class      = multimedia
    subclass   = HDA

kldload snd_hda

hdac0: <ATI (0xaaf0) HDA Controller> mem 0xfcf60000-0xfcf63fff irq 55 at device 0.1 on pci6
hdac0: link ctrl 0x2930
hdac0: disable nosnoop
hdac1: <AMD (0x1457) HDA Controller> mem 0xfce00000-0xfce07fff irq 43 at device 0.3 on pci8
hdac1: link ctrl 0x2830
hdac1: disable nosnoop
hdacc0: <ATI R6xx HDA CODEC> at cad 0 on hdac0
hdaa0: <ATI R6xx Audio Function Group> at nid 1 on hdacc0
pcm0: <ATI R6xx (HDMI)> at nid 3 on hdaa0
pcm1: <ATI R6xx (HDMI)> at nid 5 on hdaa0
pcm2: <ATI R6xx (HDMI)> at nid 7 on hdaa0
pcm3: <ATI R6xx (HDMI)> at nid 9 on hdaa0
pcm4: <ATI R6xx (HDMI)> at nid 11 on hdaa0
pcm5: <ATI R6xx (HDMI)> at nid 13 on hdaa0
hdacc1: <Realtek (0x1220) HDA CODEC> at cad 0 on hdac1
hdaa1: <Realtek (0x1220) Audio Function Group> at nid 1 on hdacc1
pcm6: <Realtek (0x1220) (Rear Analog 5.1/2.0)> at nid 20,22,21 and 24,26 on hdaa1
pcm7: <Realtek (0x1220) (Front Analog)> at nid 27 and 25 on hdaa1
pcm8: <Realtek (0x1220) (Rear Digital)> at nid 30 on hdaa1

Playing a random mp3 file via mp3blaster works out of the box, though a page fault consistently occurs if I load youtube.com in Firefox and play any video. The system immediately locks up after the video loads and sound is about to play, though luckily a core dump happens after a hard reboot.

Fatal user address access from kernel mode from firefox at ffffffff80453bcd

Fatal trap 12: page fault while in kernel mode
cpuid = 10; lapic id = 11
fault virtual address    = 0x98
fault code        = supervisor read data, page not present
instruction pointer    = 0x8:0xffffffff80453bcd
stack pointer            = 0x10:0xfffff806ae85ee08
frame pointer            = 0x10:0xfffff806ae85ee18
code segment        = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags    = interrupt enabled, resume, IOPL = 0
current process        = 915
current thread          = pri 6 
trap number        = 12
panic: page fault
cpuid = 10
Trace beginning at frame 0xfffff806ae85eb58
panic() at panic+0x2ea 0xffffffff8047ff83 
panic() at panic+0x2ea 0xffffffff8047ff83 
trap_fatal() at trap_fatal+0x529 0xffffffff808e6c33 
trap_pfault() at trap_pfault+0x1d5 0xffffffff808e63ea 
trap() at trap+0x6af 0xffffffff808e5d49 
calltrap() at calltrap+0x9 0xffffffff808a557a 
--- trap 000000000000000c, rip = ffffffff80453bcd, rsp = fffff806ae85edf0, rbp = fffff806ae85ee18 ---
knote_insert() at knote_insert+0x63 0xffffffff80453bcd

I've attached a patch that allowed me to work around the issue. Sound even plays from the videos once it's applied, though I'm not sure what the underlying issue is. dsp_kqfilter is receiving EVFILT_READ events, but for some reason rdch is NULL and wrch is not, and that leaves bs uninitialized so garbage is assigned to klist (always 0x98). My kgdb session is attached too. If there's any other debug info I can provide, let me know -- I tried adding kprintfs to understand what was going on, but got stuck.


Files

dsp.c.patch (579 Bytes) dsp.c.patch mwiencek, 06/27/2021 12:11 AM
kgdb-session (17 KB) kgdb-session mwiencek, 06/27/2021 12:11 AM
Actions #1

Updated by dillon 5 months ago

  • Assignee set to dillon
  • Priority changed from Normal to High

Yah, you definitely found an initialized return value. If the garbage in the field happened to be 0, it would try to insert an uninitialized knote, causing the panic.

Now the question is what should the proper error code be... not 1 :). I am guessing EINVAL. Try changing your assignments from -1 to EINVAL and tell me if sound still works for you.

-Matt

Actions #2

Updated by dillon 5 months ago

Er, I meant uninitialized return value :-). heh.

-Matt

Actions #3

Updated by mwiencek 5 months ago

dillon wrote:

Yah, you definitely found an initialized return value. If the garbage in the field happened to be 0, it would try to insert an uninitialized knote, causing the panic.

Now the question is what should the proper error code be... not 1 :). I am guessing EINVAL. Try changing your assignments from -1 to EINVAL and tell me if sound still works for you.

-Matt

Confirmed that sound still works using EINVAL instead of -1. Thanks for the hint...I'm a newbie at this. :)

Actions #4

Updated by dillon 5 months ago

  • Status changed from New to Resolved

Ok, I will commit the fix using EINVAL and mark the bug resolved. Great find!

-Matt

Actions #5

Updated by tuxillo 5 months ago

  • Target version changed from 13 to 6.2
Actions

Also available in: Atom PDF