Hi,

Did you check that no memory is used after free?

Did you build a kernel with WITNESS and memory debugging turned on?

--HPS

No.
How I can check mem use after free and how turn on mem debug?

Hi,

I'm afraid that pending read/write/ioctls might use freed structures. I'll try to analyze your patch carefully next week. Currently at bsdcan2017 .

--HPS

Hi,

Make a test app like this:

fd = open("/dev/dsp" ...);
while (1) {
if (ioctl(fd, SND_XXXX, XXX) != 0)
break;
}
close(fd);

And run it while you yank the USB audio device. Also try reading(), writing() and mmap() in a loop when detaching.

--HPS

Thank you.

Im not sure about race condition in case: app read/write/ioctl/close and in same time unplug code started in another thread.
May be destroy_dev() handle this.
If yes then I'm sure that mixer OK, but dsp code match more complicated, so I hope that some one with expert knowledge in OSS and dev subsystem will rewiew/help.

destroy_dev() will make sure all system calls have returned. In your patch are you destroying the device first?

--HPS

I think you approach may work for the mixer case, assuming no IOCTLs are sleeping. Please make sure that destroy_dev() will flush all pending system calls.

https://cgit.freebsd.org/ports/commit/?id=3bc8803e5c4a96b60ffe5fa6887e2b73e0df7756

FYI

D43545 takes care of this change. Should we close this?