kern/39899: audio attach with pad(4) segfaults

[heas%shrubbery.net@localhost]

>Number:         39899
>Category:       kern
>Synopsis:       audio attach with pad(4) segfaults
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 11 22:55:00 +0000 2008
>Originator:     john heasley
>Release:        NetBSD 5.99.01
>Organization:
        
>Environment:
System: NetBSD 5.99.01 Sun v20z
Architecture: amd64
Machine: amd64
>Description:
A kernel, with essentially all audio devices removed, segfaults in the
audio(4) attach from pad(4) when audiosetinfo() calls audio_calcwater()
around audio.c:3591 because ((audio_softc *)sc)->sc_pustream is NULL.

As follows with some debug printfs:
pad0: outputs: 44100Hz, 16-bit, stereo
audio0 at pad0: half duplex
audio audiosetinfo: oldpblksize 0, oldrblksize 0
audio audiosetinfo: sc->sc_pr.blksize 1024, sc->sc_rr.blksize 1024
audio audiosetinfo: sc->sc_pustream 0x0, sc->sc_rustream 0x0
audio audiosetinfo: oldpus 0x0, oldrus 0x0
audio audio_calcwater: 0x0
uvm_fault(0xffffffff80842aa0, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff802e25d8 cs 8 rflags 10282 cr2  10 cpl 6 rsp 
ffffffff80954340
kernel: page fault trap, code=0
Stopped in pid 0.1 (system) at  netbsd:audio_calcwater+0x28:    movq    
0x10(%rdx),%rax
db{0}> bt     
audio_calcwater() at netbsd:audio_calcwater+0x28
audiosetinfo() at netbsd:audiosetinfo+0x54e
audio_set_defaults() at netbsd:audio_set_defaults+0xdd
audioattach() at netbsd:audioattach+0x18f
config_attach_loc() at netbsd:config_attach_loc+0x14a
audio_attach_mi() at netbsd:audio_attach_mi+0x2d
pad_attach() at netbsd:pad_attach+0xc1
config_attach_pseudo() at netbsd:config_attach_pseudo+0x33
padattach() at netbsd:padattach+0x59
config_finalize() at netbsd:config_finalize+0x5f
main() at netbsd:main+0x242

>How-To-Repeat:
Comment all audio devices except:
audio*  at audiobus?
midi*   at pcppi?               # MIDI interface to the PC speaker
pseudo-device   pad 

>Fix:
audio_calcwater() should check for NULL or audioattach() should initialize
sc_pustream, if sc_pustream is necessary for pad(4)?