panic upon kldunload snd_ich (lor # 159)

Hi everyone,

I see that this panic is caused by lor #159
http://sources.zabbadoz.net/freebsd/lor.html#159
but I figured I'd report it to see if it will help anyone

Booting to single user and issuing:
# kldload snd_ich
# kldunload snd_ich

are sufficient to trigger the panic on my system. I know that Alexander 
Leidinger has recently committed some bits to current in the sound code, but 
it is unclear if it will fix my panic; I'm currently cvsup-ing and building 
world to find out.

The machine in question is:

bash-2.05b$ uname -a
FreeBSD prolepsis.math.uiuc.edu <http://prolepsis.math.uiuc.edu>
7.0-CURRENTFreeBSD
7.0-CURRENT #9: Thu Aug 25 06:22:00 UTC 2005
kaduk_at_prolepsis.math.uiuc.edu:/usr/obj/usr/src/sys/PROLEPSIS
i386

As shown below, I have a core to play with, so if this needs fixing, tell me 
what I can do to help.

Thanks

Ben Kaduk




prolepsis# kgdb kernel.debug /usr/vmcore.1
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: 
Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
lock order reversal
1st 0xc2d72b00 pcm0 (sound cdev) _at_ 
/usr/src/sys/modules/sound/sound/../../../dev/sound/pcm/sound.c:713
2nd 0xc2dbbda0 sndstat (sndstat) _at_ 
/usr/src/sys/modules/sound/sound/../../../dev/sound/pcm/sndstat.c:256
KDB: stack backtrace:
kdb_backtrace(c06ee074,c2dbbda0,c2db6dcf,c2db6dcf,c2db6dd7) at 
kdb_backtrace+0x2f
witness_checkorder(c2dbbda0,9,c2db6dd7,100,c0723a40) at 
witness_checkorder+0x6d0
_sx_xlock(c2dbbda0,c2db6dd7,100,0,c2a59a00) at _sx_xlock+0x7f
sndstat_unregister(c2784700,c2b14380,c2db6ed5,2c9,c2784700) at 
sndstat_unregister+0x27
pcm_unregister(c2784700,ef8fcbfc,c0557ac6,c2d8a820,c2784700) at 
pcm_unregister+0x112
ich_pci_detach(c2784700,c2bbc050,c0720308,961,c2770bd0) at 
ich_pci_detach+0x13
device_detach(c2784700,c2d89428,c2784700,c26e9400,c2d8a80c) at 
device_detach+0x8f
devclass_delete_driver(c26e9400,c2d8a820,1,c2d4eb00,c2d4eb00) at 
devclass_delete_driver+0x8e
driver_module_handler(c2d4eb00,1,c2d8a80c) at driver_module_handler+0xe7
module_unload(c2d4eb00,0,1fb,0,0) at module_unload+0x61
linker_file_unload(c2d70000,0,c06e8663,327,0) at linker_file_unload+0x89
kern_kldunload(c2e62640,6,0,ef8fcd30,c06ae89d) at kern_kldunload+0x96
kldunloadf(c2e62640,ef8fcd04,8,422,2) at kldunloadf+0x2c
syscall(3b,3b,3b,6,bfbfee22) at syscall+0x295
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (444, FreeBSD ELF32, kldunloadf), eip = 0x280b6f47, esp = 
0xbfbfe8ac, ebp = 0xbfbfed18 ---
pcm0: detached
panic: sx_destroy (sndstat): holders or waiters

KDB: enter: panic
Dumping 1023 MB (2 chunks)
chunk 0: 1MB (159 pages) ... ok
chunk 1: 1023MB (261806 pages) 1007 991 975 959 943 927 911 895 879 863 847 
831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 
527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 
223 207 191 175 159 143 127 111 95 79 63 47 31 15

#0 doadump () at pcpu.h:165
165 __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) 

#0 doadump () at pcpu.h:165
#1 0xc04492fa in db_fncall (dummy1=0, dummy2=0, dummy3=1999, 
dummy4=0xef8fca38 " TtÀ") at /usr/src/sys/ddb/db_command.c:486
#2 0xc04490a4 in db_command (last_cmdp=0xc0744b24, cmd_table=0x0, 
aux_cmd_tablep=0xc070d9e4, aux_cmd_tablep_end=0xc070d9e8)
at /usr/src/sys/ddb/db_command.c:401
#3 0xc0449195 in db_command_loop () at /usr/src/sys/ddb/db_command.c:452
#4 0xc044b039 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:221
#5 0xc055775c in kdb_trap (type=0, code=0, tf=0xef8fcb84)
at /usr/src/sys/kern/subr_kdb.c:473
#6 0xc06adfea in trap (frame=
{tf_fs = -1066532856, tf_es = 40, tf_ds = -275840984, tf_edi = 1, tf_esi = 
-1066488724, tf_ebp = -275788852, tf_isp = -275788880, tf_ebx = -275788796, 
tf_edx = 1, tf_ecx = -1052684288, tf_eax = 18, tf_trapno = 3, tf_err = 0, 
tf_eip = -1068141358, tf_cs = 32, tf_eflags = 646, tf_esp = -1066481942, 
tf_ss = -1066490330}) at /usr/src/sys/i386/i386/trap.c:601
#7 0xc069c18a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#8 0xc06e0008 in ?? ()
#9 0x00000028 in ?? ()
#10 0xef8f0028 in ?? ()
#11 0x00000001 in ?? ()
#12 0xc06eac6c in ?? ()
#13 0xef8fcbcc in ?? ()
#14 0xef8fcbb0 in ?? ()
#15 0xef8fcc04 in ?? ()
#16 0x00000001 in ?? ()
#17 0xc1415000 in ?? ()
#18 0x00000012 in ?? ()
#19 0x00000003 in ?? ()
#20 0x00000000 in ?? ()
#21 0xc05574d2 in kdb_enter (msg=0x0) at cpufunc.h:60
#22 0xc053b25c in panic (fmt=0xc06eac6c "%s (%s): holders or waiters\n")
at /usr/src/sys/kern/kern_shutdown.c:537
#23 0xc05412e2 in sx_destroy (sx=0xc2dbbda0) at 
/usr/src/sys/kern/kern_sx.c:96
#24 0xc2db2adb in ?? ()
#25 0xc2dbbda0 in ?? ()
#26 0xc2db6dd7 in ?? ()
#27 0x00000167 in ?? ()
#28 0xef8fcc50 in ?? ()
#29 0xc052ad83 in linker_file_sysuninit (lf=0x0)
at /usr/src/sys/kern/kern_linker.c:238
Previous frame identical to this frame (corrupt stack?)