kern/41957: azalia crashes during boot - uvm_fault

[xbarken%googlemail.com@localhost]

>Number:         41957
>Category:       kern
>Synopsis:       azalia crashes during boot - uvm_fault
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 29 15:45:00 +0000 2009
>Originator:     Björn Barkenfelt
>Release:        5.0.1
>Organization:
>Environment:
NetBSD titan 5.0.1 NetBSD 5.0.1 (TITAN) #1: Sat Aug 22 01:03:01 CEST 2009  
barken@titan:/home/barken/code/netbsd/src/sys/arch/amd64/compile/obj/TITAN amd64
>Description:
The generic kernel crashed upon boot on my system. The azalia driver generates 
a uvm_fault during boot.
The problem lies in azalia_codec.c where an initialization of a pointer is made 
before a realloc(). A fix for 5.0.1 release is included, which solves the 
problem for me. 

/ Björn


>How-To-Repeat:
Difficult to say, I guess a realloc() in the mixer init code is necessary only 
on some systems/combinations of hardware. On a lot of other systems, the code 
might work, possible because realloc() not always moves the memory block.
On my system, I can repeat the problem just by booting with the GENERIC kernel.
>Fix:
Apply the following patch to /usr/src/sys/dec/pci/azalia_codec.c

3166c3166
<       mixer_item_t *m = NULL;
---
>       mixer_item_t *m, *mdac = NULL;
3168c3168
<       int err, i, imdac;
---
>       int err, i;
3181c3181
<       for (i = 0, imdac = -1; i < this->nmixers; i++)
---
>       for (i = 0; i < this->nmixers; i++)
3183,3189c3183
<                       /*  
<                       *  Rememer at which index we found the mdac. 
<                       *  Setting a pointer is dangerous at this point
<                       *  due to a possile realloc() further below
<                       *  in generic_mixer_ensure_capacity().
<                       */
<                       imdac = i;
---
>                       mdac = &this->mixers[i];
3192,3193c3186
< 
<       if (imdac >= 0 ) {
---
>       if (mdac) {
3204,3205c3197
< 
<               memcpy(m, &this->mixers[imdac], sizeof(*m));
---
>