Re: kernel panic with snd_hda "panic: Duplicate free of item 0xffffff00025f8c00 from zone 0xffffff00b697d400(1024)"

Alexander Motin wrote:
> Lawrence Stewart wrote:
>> I'm getting a kernel panic with the snd_hda driver on fresh 8-CURRENT 
>> amd64 (r190518). I received this panic the other day when loading the 
>> module from the command line on a slightly older kernel revision (I 
>> think it was r190437). After putting the module load into 
>> /boot/loader.conf, the problem didn't occur again and sound worked 
>> just fine on subsequent reboots.
>>
>> A few minutes ago I installed the new r190518 kernel and now it panics 
>> consistently with the same message every time. It also panics if I 
>> unload the module at the loader prompt, boot the kernel and then 
>> kldload on the command line.
>>
>> Hardware is a Toshiba Portege R600 laptop. Details below are hand 
>> transcribed as the machine doesn't have a serial port.
>>
>> Relevant bit of verbose boot message when it panics:
>>
>> hdac0: <Intel 82801I High Definition Audio Controller> at device 27.0 on
>>        pci0
>> hdac0: HDA driver revision: 20090316_0130
>> hdac0: Lazy allocation of 0x4000 bytes rid 0x10 type 3 at 0xb69a4000
>> hdac0: Reserved 0x4000 bytes for rid 0x10 type 3 at 0xb69a4000
>> hdac0: attempting to allocate 1 MSI vectors (1 supported)
>> hdac0: using IRQ 257 for MSI
>> msi: Assinging MSI IRQ 257 to local APIC 0 vector 53
>> hdac0: [MPSAFE]
>> hdac0: [ITHREAD]
>> hdac0: hdac_get_capabilities: Invalid corb size (0)
>> device_attach: hdac0 attach returned 6
>> Slab at 0xffffff00025d5b18, freei 3 = 0.
>> panic: Duplicate free of item 0xffffff00025f8c00 from zone 
>> 0xffffff00b697d400(1024)
>>
>> Any idea what the issue(s) might be?
> 
> I can't reproduce neither "Invalid corb size (0)" error, nor the crash 
> in case of it. I have tried to simulate that error, but system handled 
> it correctly. But I have INVARIANTS disabled on my system.
> 
> Can you try to disable MSI?

Setting hw.pci.enable_msix=0 and hw.pci.enable_msi=0 at the loader 
prompt made no difference.

> 
> Can you try to move hdac_irq_alloc() call after hdac_rirb_init() in 
> hdac_attach()? May be interrupt shots while something is not yet 
> initialized?
> 

Running with the following patch made no difference either.

lstewart-laptop# svn diff dev/sound/pci/hda/hdac.c
Index: dev/sound/pci/hda/hdac.c
===================================================================
--- dev/sound/pci/hda/hdac.c    (revision 190518)
+++ dev/sound/pci/hda/hdac.c    (working copy)
_at__at_ -4145,9 +4145,6 _at__at_
         result = hdac_mem_alloc(sc);
         if (result != 0)
                 goto hdac_attach_fail;
-       result = hdac_irq_alloc(sc);
-       if (result != 0)
-               goto hdac_attach_fail;

         /* Get Capabilities */
         result = hdac_get_capabilities(sc);
_at__at_ -4174,6 +4171,10 _at__at_
         hdac_corb_init(sc);
         hdac_rirb_init(sc);

+       result = hdac_irq_alloc(sc);
+       if (result != 0)
+               goto hdac_attach_fail;
+
         /* Defer remaining of initialization until interrupts are 
enabled */
         sc->intrhook.ich_func = hdac_attach2;
         sc->intrhook.ich_arg = (void *)sc;




Any other ideas I could try?

Cheers,
Lawrence