>Number:         32563
>Category:       kern
>Synopsis:       audioctl of death
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 18 19:55:00 +0000 2006
>Originator:     Christian Biere
>Release:        NetBSD 3.99.14
>Environment:
System: NetBSD cyclonus 3.99.14 NetBSD 3.99.14 (STARSCREAM) #6: Tue Dec 13 12:46:50 CET 2005 bin@cyclonus:/o/NetBSD/obj/sys/arch/i386/compile/STARSCREAM i386
Architecture: i386
Machine: i386
>Description:

uvm_fault(0xcb808e0c, 0, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip 0 cs 8 eflags 10206 cr2 0 ilevel 0
panic: trap
Begin traceback...
trap() at netbsd:trap+0x171
--- trap (number 6) ---
?(c0942800,cb2abec4,214,c01f9b0a,cb2abe24) at 0
audiowrite(2a80,cb2abec4,214,0,1) at netbsd:audiowrite+0xa0
spec_write(cb2abe24,cb030a80,cb2abe4c,c024ad96,cb2abe24) at netbsd:spec_write+0x80
ufsspec_write(cb2abe24,c024b2c2,cb2abe4c,c024898e,c030fd80) at netbsd:ufsspec_write+0x3a
VOP_WRITE(cb030a80,cb2abec4,214,ca6a0930,2a9cadc0) at netbsd:VOP_WRITE+0x36
vn_write(cb7ff140,cb7ff16c,cb2abec4,ca6a0930,1) at netbsd:vn_write+0xf0
dofilewrite(cb287424,1,cb7ff140,bfbfeb8c,4) at netbsd:dofilewrite+0x9f
sys_write(cb287424,cb2abf64,cb2abf5c,cb28500c,10) at netbsd:sys_write+0x71
syscall_plain() at netbsd:syscall_plain+0x85
--- syscall (number 4) ---
0xbbb55e73:
End traceback...

NetBSD 3.99.14 (STARSCREAM) #6: Tue Dec 13 12:46:50 CET 2005
	bin@cyclonus:/o/NetBSD/obj/sys/arch/i386/compile/STARSCREAM
total memory = 255 MiB
avail memory = 247 MiB
BIOS32 rev. 0 found at 0xfdae0
mainbus0 (root)
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: AMD Duron (686-class), 1394.12 MHz, id 0x681
cpu0: features c1c3fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR>
cpu0: features c1c3fbff<PGE,MCA,CMOV,PAT,PSE36,MMXX,MMX>
cpu0: features c1c3fbff<FXSR,3DNOW2,3DNOW>
cpu0: "AMD Duron(tm) Processor"
cpu0: I-cache 64 KiB 64B/line 2-way, D-cache 64 KiB 64B/line 2-way
cpu0: L2 cache 64 KiB 64B/line 16-way
cpu0: ITLB 16 4 KiB entries fully associative, 8 4 MiB entries fully associative
cpu0: DTLB 32 4 KiB entries fully associative, 8 4 MiB entries 4-way
cpu0: calibrating local timer
cpu0: apic clock running at 265 MHz
cpu0: 8 page colors
ioapic0 at mainbus0 apid 2 (I/O APIC)
ioapic0: pa 0xfec00000, version 11, 24 pins
acpi0 at mainbus0
acpi0: using Intel ACPI CA subsystem version 20050408
acpi0: X/RSDT: OemId <AMIINT,SiS735XX,00001000>, AslId <MSFT,0100000b>
acpi0: SCI interrupting at int 9
acpi0: fixed-feature power button present
ACPI Object Type 'Processor' (0x0c) at acpi0 not configured
PNP0A03 at acpi0 not configured
PNP0200 at acpi0 not configured
attimer0 at acpi0 (PNP0100): AT Timer
attimer0: io 0x40-0x43 irq 0
PNP0B00 at acpi0 not configured
PNP0800 at acpi0 not configured
npx0 at acpi0 (PNP0C04)
npx0: io 0xf0-0xff irq 13
npx0: using exception 16
pckbc0 at acpi0 (PNP0F03): aux port
pckbc0: irq 12
pckbc1 at acpi0 (PNP0303): kbd port
pckbc1: io 0x60,0x64 irq 1
fdc0 at acpi0 (PNP0700)
fdc0: io 0x3f2-0x3f5,0x3f7 irq 6 drq 2
com0 at acpi0 (PNP0501-1)
com0: io 0x3f8-0x3ff irq 4
com0: ns16550a, working fifo
com1 at acpi0 (PNP0501-2)
com1: io 0x2f8-0x2ff irq 3
com1: ns16550a, working fifo
lpt0 at acpi0 (PNP0400)
lpt0: io 0x378-0x37f irq 7
ACPI Object Type 'Power' (0x0b) at acpi0 not configured
ACPI Object Type 'Power' (0x0b) at acpi0 not configured
ACPI Object Type 'Power' (0x0b) at acpi0 not configured
ACPI Object Type 'Power' (0x0b) at acpi0 not configured
PNP0C0F at acpi0 not configured
PNP0C0F at acpi0 not configured
acpibut0 at acpi0 (PNP0C0E): ACPI Sleep Button
pckbd0 at pckbc1 (kbd slot)
pckbc1: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pms0 at pckbc1 (aux slot)
pckbc1: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
pchb0 at pci0 dev 0 function 0
pchb0: Silicon Integrated System 735 Host Bridge (rev. 0x01)
agp0 at pchb0: aperture at 0xd0000000, size 0x4000000
ppb0 at pci0 dev 1 function 0: Silicon Integrated System 86C201 (rev. 0x00)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled
vga0 at pci1 dev 0 function 0: Matrox MGA G400 AGP (rev. 0x85)
wsdisplay0 at vga0 kbdmux 1: console (80x25, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
pcib0 at pci0 dev 2 function 0
pcib0: Silicon Integrated System 85C503 or 5597/5598 ISA bridge (rev. 0x00)
siside0 at pci0 dev 2 function 5
siside0: Silicon Integrated Systems 735 IDE controller (rev. 0xd0)
siside0: bus-master DMA support present
siside0: primary channel wired to compatibility mode
siside0: primary channel interrupting at ioapic0 pin 14 (irq 14)
atabus0 at siside0 channel 0
siside0: secondary channel wired to compatibility mode
siside0: secondary channel interrupting at ioapic0 pin 15 (irq 15)
atabus1 at siside0 channel 1
sip0 at pci0 dev 3 function 0: SiS 900 10/100 Ethernet, rev 0x90
sip0: interrupting at ioapic0 pin 22 (irq 10)
sip0: Ethernet address 00:07:95:a9:a5:7f
ukphy0 at sip0 phy 1: Generic IEEE 802.3u media interface
ukphy0: OUI 0x000004, model 0x0020, rev. 1
ukphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
cmpci0 at pci0 dev 15 function 0: C-Media Electronics CMI8738/C3DX PCI Audio Device (rev. 0x10)
cmpci0: interrupting at ioapic0 pin 19 (irq 11)
audio0 at cmpci0: full duplex, mmap, independent
opl at cmpci0 not configured
mpu at cmpci0 not configured
isa0 at pcib0
ioapic0: enabling
fd0 at fdc0 drive 0: 1.44MB, 80 cyl, 2 head, 18 sec
wd0 at atabus0 drive 0: <SAMSUNG SV1203N>
wd0: drive supports 16-sector PIO transfers, LBA48 addressing
wd0: 120 GB, 232632 cyl, 16 head, 63 sec, 512 bytes/sect x 234493056 sectors
wd0: 32-bit data port
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 5 (Ultra/100)
wd0(siside0:0:0): using PIO mode 4, Ultra-DMA mode 5 (Ultra/100) (using DMA)
atapibus0 at atabus1: 2 targets
cd0 at atapibus0 drive 1: <LG CD-RW CED-8080B, 2000/08/17, 1.08> cdrom removable
cd0: 32-bit data port
cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2 (Ultra/33)
cd0(siside0:1:1): using PIO mode 4, Ultra-DMA mode 2 (Ultra/33) (using DMA)
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
warning: no /dev/console

>How-To-Repeat:

  $ cat /dev/urandom > /dev/audio0	# play a Britney Spears song
  $ audioctl -w play.rate=44100		# change play rate from 8 kHz

  *enjoy*

>Fix: