>Number:         23816
>Category:       kern
>Synopsis:       When recording by uaudio, kernel panic.
>Confidential:   no
>Severity:       critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Dec 21 06:29:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     
>Release:        NetBSD 1.6ZG (-current at about Dec 19 15:00 GMT)
>Organization:
>Environment:
System: NetBSD kaoru 1.6ZG NetBSD 1.6ZG (KAORU.1.6ZF) #165: Sun Dec 21 03:01:07 JST 2003 root@kaoru:/sys/arch/i386/compile/KAORU.1.6ZF i386
Architecture: i386
Machine: i386
>Description:
When setmode don't have and usemode have AUMODE_RECORD flag
in uaudio_set_params() function of src/sys/dev/usb/uaudio.c,
raltidx keeps -1, uaudio_set_params() refers to sc->sc_alts[raltidx],
and kernel panic occurs.
>How-To-Repeat:
audiorecord foo.wav
>Fix:
--- src/sys/dev/usb/uaudio.c.orig	2003-10-26 02:49:52.000000000 +0900
+++ src/sys/dev/usb/uaudio.c	2003-12-21 02:59:22.000000000 +0900
@@ -2519,6 +2519,27 @@
 		}
 	}
 
+	for (mode = AUMODE_RECORD; mode != -1;
+	     mode = mode == AUMODE_RECORD ? AUMODE_PLAY : -1) {
+		if ((usemode & ~(setmode) & mode) == 0)
+			continue;
+
+		if ((sc->sc_mode & mode) == 0)
+			continue;
+
+		p = (mode == AUMODE_PLAY) ? play : rec;
+		i = uaudio_match_alt(sc->sc_nalts, sc->sc_alts, p, mode);
+		if (i < 0)
+			return (EINVAL);
+		if (mode == AUMODE_PLAY) {
+			paltidx = i;
+			sc->sc_alts[i].sc_busy = 1;
+		} else {
+			raltidx = i;
+			sc->sc_alts[i].sc_busy = 1;
+		}
+	}
+
 	if ((usemode & AUMODE_PLAY) /*&& paltidx != sc->sc_playchan.altidx*/) {
 		/* XXX abort transfer if currently happening? */
 		uaudio_chan_init(&sc->sc_playchan, paltidx, play, 0);
>Release-Note:
>Audit-Trail:
>Unformatted: