From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 52C01C32771 for ; Mon, 26 Sep 2022 10:22:56 +0000 (UTC) Received: from alsa1.perex.cz (alsa1.perex.cz [207.180.221.201]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by alsa0.perex.cz (Postfix) with ESMTPS id 9A2DA1F7; Mon, 26 Sep 2022 12:22:04 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa0.perex.cz 9A2DA1F7 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=alsa-project.org; s=default; t=1664187774; bh=KHfsV4bZY+/jDPdaKd+8kmDRZ+5SiZ1LkNrEWXPTAPo=; h=Date:From:To:Subject:In-Reply-To:References:Cc:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=vJLHp618VyUCNY9ijiofthjTzj0q9RE4BQAaRUYxF2ElLQ3WxsjqaWLTqB0GmRL4y /e1rYuPfuf9/fLmAdyCJY3Z3Y1qDE1zqT92VPl4ee/YMlGba4Fso3Q2QMzBfHUl8mo JA7XlvSq5n3rDqhmhH8OAEAe0CoYRkmU4yTBh+YA= Received: from alsa1.perex.cz (localhost.localdomain [127.0.0.1]) by alsa1.perex.cz (Postfix) with ESMTP id 2CCEEF80254; Mon, 26 Sep 2022 12:22:04 +0200 (CEST) Received: by alsa1.perex.cz (Postfix, from userid 50401) id 7E3FCF8027D; Mon, 26 Sep 2022 12:22:02 +0200 (CEST) Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by alsa1.perex.cz (Postfix) with ESMTPS id DE44DF8011C for ; Mon, 26 Sep 2022 12:21:59 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.11.0 alsa1.perex.cz DE44DF8011C Authentication-Results: alsa1.perex.cz; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.b="fM0Lj0fk"; dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de header.b="Ncn7A3pT" Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id BA11421D41; Mon, 26 Sep 2022 10:21:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1664187718; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IvMa37npacHpbAX5g7cN2E1FOSjgq1tbUEWll5oX/T0=; b=fM0Lj0fk/iS+nbEHZmRxVteEj6RwYdjHfRagwjQH/9hI7hIBsLruuHBifmG3XKw8IUZLz1 OQWMXUtHY+Dmq54ykW9brdaavq2fDAgzx/XPddVIeEzQ2L0N1usTnTy41zuRxWNb2+F1JT EvyYdbbLKmv3afKepjynWZyH1NSbMlU= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1664187718; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IvMa37npacHpbAX5g7cN2E1FOSjgq1tbUEWll5oX/T0=; b=Ncn7A3pTPKHOafFWzg/o8aXslG6m39qQdHBGWQ0NlSTL8NU6dOZSIViYs2BiD+33MeWIiM eUQaT/NML+R8mKBw== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 883AB139BD; Mon, 26 Sep 2022 10:21:58 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 0yr5HkZ9MWNuEgAAMHmgww (envelope-from ); Mon, 26 Sep 2022 10:21:58 +0000 Date: Mon, 26 Sep 2022 12:21:58 +0200 Message-ID: <87v8pa306x.wl-tiwai@suse.de> From: Takashi Iwai To: butt3rflyh4ck Subject: Re: A divide error bug in snd_pcm_write In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: alsa-devel@alsa-project.org, LKML , pierre-louis.bossart@linux.intel.com, tiwai@suse.com, broonie@kernel.org X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: "Alsa-devel" On Mon, 26 Sep 2022 11:26:17 +0200, butt3rflyh4ck wrote: > > Hi, there is a divide error bug in snd_pcm_write in > sound/core/pcm_native.c in the latest kernel. > > ##Root Cause > When open the device of /dev/snd/pcmC#D#p, there would attach a > runtime to pcm->substream via snd_pcm_open_substream. see the code > below: > ``` > int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, > struct file *file, > struct snd_pcm_substream **rsubstream) > { > ...... > > runtime = kzalloc(sizeof(*runtime), GFP_KERNEL); > if (runtime == NULL) > return -ENOMEM; > > size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status)); > runtime->status = alloc_pages_exact(size, GFP_KERNEL); > if (runtime->status == NULL) { > kfree(runtime); > return -ENOMEM; > } > memset(runtime->status, 0, size); > > size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_control)); > runtime->control = alloc_pages_exact(size, GFP_KERNEL); > if (runtime->control == NULL) { > free_pages_exact(runtime->status, > PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status))); > kfree(runtime); > return -ENOMEM; > } > memset(runtime->control, 0, size); > > init_waitqueue_head(&runtime->sleep); > init_waitqueue_head(&runtime->tsleep); > > runtime->status->state = SNDRV_PCM_STATE_OPEN; > mutex_init(&runtime->buffer_mutex); > atomic_set(&runtime->buffer_accessing, 0); > > substream->runtime = runtime; > substream->private_data = pcm->private_data; > substream->ref_count = 1; > substream->f_flags = file->f_flags; > substream->pid = get_pid(task_pid(current)); > pstr->substream_opened++; > *rsubstream = substream; > return 0; > } > ``` > It would kzmalloc a new runtime. And initialize runtime simply. > If we write some data to the device. it would call snd_pcm_write or > snd_pcm_writev. and read some date from the device, it would call > snd_pcm_read or snd_pcm_readv. > Anyway, the four function would use data of runtime, but some data of > runtime is NULL not be initialized, see the code below: > ``` > static ssize_t snd_pcm_write(struct file *file, const char __user *buf, > size_t count, loff_t * offset) > { > struct snd_pcm_file *pcm_file; > struct snd_pcm_substream *substream; > struct snd_pcm_runtime *runtime; > snd_pcm_sframes_t result; > > pcm_file = file->private_data; > substream = pcm_file->substream; > if (PCM_RUNTIME_CHECK(substream)) > return -ENXIO; > runtime = substream->runtime; > if (runtime->status->state == SNDRV_PCM_STATE_OPEN || > runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED) > return -EBADFD; > if (!frame_aligned(runtime, count)) /////// [1] > return -EINVAL; > count = bytes_to_frames(runtime, count); /////// [2] > result = snd_pcm_lib_write(substream, buf, count); > if (result > 0) > result = frames_to_bytes(runtime, result); > return result; > } > ``` > [1] call frame_aligned to aligned. > ``` > static inline int frame_aligned(struct snd_pcm_runtime *runtime, ssize_t bytes) > { > return bytes % runtime->byte_align == 0; > } > ``` > but runtime->byte_align is NULL. > > [2] call bytes_to_frames. > ``` > static inline ssize_t frames_to_bytes(struct snd_pcm_runtime *runtime, > snd_pcm_sframes_t size) > { > return size * runtime->frame_bits / 8; > } > ``` > but runtime->frame_bits is NULL. > > ##reproduce it > [ 1189.305083][ T4656] divide error: 0000 [#1] PREEMPT SMP > [ 1189.305600][ T4656] CPU: 1 PID: 4656 Comm: snd_pcm_write Not > tainted 6.0.0-rc7 #16 > [ 1189.306157][ T4656] Hardware name: QEMU Standard PC (i440FX + PIIX, > 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 > [ 1189.306760][ T4656] RIP: 0010:snd_pcm_write+0x33/0xa0 > [ 1189.307155][ T4656] Code: 8b 38 48 85 ff 74 72 48 8b 9f c0 00 00 00 > 48 85 db 74 66 48 8b 83 00 01 00 00 f7 00 f7 ff ff ff 74 6b 48 89 d0 > 48 89 d1 31 d2 <48> f7 b3 91 > [ 1189.308553][ T4656] RSP: 0018:ffffc9000adc7e68 EFLAGS: 00010246 > [ 1189.309034][ T4656] RAX: 0000000000000000 RBX: ffff888048ec2000 > RCX: 0000000000000000 > [ 1189.309583][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 > RDI: ffff888046fc9c00 > [ 1189.310163][ T4656] RBP: 0000000000000000 R08: 0000000000000000 > R09: 0000000000020026 > [ 1189.310679][ T4656] R10: 0000000000000001 R11: 0000000000000000 > R12: 0000000000000000 > [ 1189.311226][ T4656] R13: ffffc9000adc7f08 R14: 0000000000000000 > R15: 0000000000000000 > [ 1189.311754][ T4656] FS: 00000000012d8880(0000) > GS:ffff88807ec00000(0000) knlGS:0000000000000000 > [ 1189.312350][ T4656] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 1189.312780][ T4656] CR2: 0000000020000000 CR3: 000000004b496000 > CR4: 00000000000006e0 > [ 1189.313234][ T4656] Call Trace: > [ 1189.313424][ T4656] > [ 1189.313597][ T4656] vfs_write+0xe6/0x4d0 > [ 1189.313836][ T4656] ksys_write+0x60/0xe0 > [ 1189.314071][ T4656] do_syscall_64+0x35/0xb0 > [ 1189.314324][ T4656] entry_SYSCALL_64_after_hwframe+0x63/0xcd > [ 1189.314734][ T4656] RIP: 0033:0x44dc3d > [ 1189.315007][ T4656] Code: 28 c3 e8 36 29 00 00 66 0f 1f 44 00 00 f3 > 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b > 4c 24 08 0f 05 <48> 3d 01 f8 > [ 1189.316338][ T4656] RSP: 002b:00007ffcbdf5ef38 EFLAGS: 00000246 > ORIG_RAX: 0000000000000001 > [ 1189.317012][ T4656] RAX: ffffffffffffffda RBX: 0000000000400530 > RCX: 000000000044dc3d > [ 1189.317693][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 > RDI: 0000000000000003 > [ 1189.318172][ T4656] RBP: 00007ffcbdf5ef50 R08: 0000000082000000 > R09: 0000000000000000 > [ 1189.318648][ T4656] R10: 000000000000ffff R11: 0000000000000246 > R12: 00000000004030a0 > [ 1189.319182][ T4656] R13: 0000000000000000 R14: 00000000004c5018 > R15: 0000000000000000 The question is how the code passes the check before [1]: if (runtime->status->state == SNDRV_PCM_STATE_OPEN || runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED) return -EBADFD; The uninitialized state should have been with SNDRV_PCM_STATE_OPEN, and runtime->byte_align is set up at snd_pcm_hw_params() followed by snd_pcm-set_state() to chage the state to SNDRV_PCM_STATE_SETUP. Which kernel version are you testing? Takashi From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9568C07E9D for ; Mon, 26 Sep 2022 10:38:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236156AbiIZKiK (ORCPT ); Mon, 26 Sep 2022 06:38:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41176 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236056AbiIZKgx (ORCPT ); Mon, 26 Sep 2022 06:36:53 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8BADC5281C for ; Mon, 26 Sep 2022 03:22:00 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id BA11421D41; Mon, 26 Sep 2022 10:21:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1664187718; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IvMa37npacHpbAX5g7cN2E1FOSjgq1tbUEWll5oX/T0=; b=fM0Lj0fk/iS+nbEHZmRxVteEj6RwYdjHfRagwjQH/9hI7hIBsLruuHBifmG3XKw8IUZLz1 OQWMXUtHY+Dmq54ykW9brdaavq2fDAgzx/XPddVIeEzQ2L0N1usTnTy41zuRxWNb2+F1JT EvyYdbbLKmv3afKepjynWZyH1NSbMlU= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1664187718; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IvMa37npacHpbAX5g7cN2E1FOSjgq1tbUEWll5oX/T0=; b=Ncn7A3pTPKHOafFWzg/o8aXslG6m39qQdHBGWQ0NlSTL8NU6dOZSIViYs2BiD+33MeWIiM eUQaT/NML+R8mKBw== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 883AB139BD; Mon, 26 Sep 2022 10:21:58 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 0yr5HkZ9MWNuEgAAMHmgww (envelope-from ); Mon, 26 Sep 2022 10:21:58 +0000 Date: Mon, 26 Sep 2022 12:21:58 +0200 Message-ID: <87v8pa306x.wl-tiwai@suse.de> From: Takashi Iwai To: butt3rflyh4ck Cc: perex@perex.cz, tiwai@suse.com, pierre-louis.bossart@linux.intel.com, broonie@kernel.org, alsa-devel@alsa-project.org, LKML Subject: Re: A divide error bug in snd_pcm_write In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0 MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 26 Sep 2022 11:26:17 +0200, butt3rflyh4ck wrote: > > Hi, there is a divide error bug in snd_pcm_write in > sound/core/pcm_native.c in the latest kernel. > > ##Root Cause > When open the device of /dev/snd/pcmC#D#p, there would attach a > runtime to pcm->substream via snd_pcm_open_substream. see the code > below: > ``` > int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, > struct file *file, > struct snd_pcm_substream **rsubstream) > { > ...... > > runtime = kzalloc(sizeof(*runtime), GFP_KERNEL); > if (runtime == NULL) > return -ENOMEM; > > size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status)); > runtime->status = alloc_pages_exact(size, GFP_KERNEL); > if (runtime->status == NULL) { > kfree(runtime); > return -ENOMEM; > } > memset(runtime->status, 0, size); > > size = PAGE_ALIGN(sizeof(struct snd_pcm_mmap_control)); > runtime->control = alloc_pages_exact(size, GFP_KERNEL); > if (runtime->control == NULL) { > free_pages_exact(runtime->status, > PAGE_ALIGN(sizeof(struct snd_pcm_mmap_status))); > kfree(runtime); > return -ENOMEM; > } > memset(runtime->control, 0, size); > > init_waitqueue_head(&runtime->sleep); > init_waitqueue_head(&runtime->tsleep); > > runtime->status->state = SNDRV_PCM_STATE_OPEN; > mutex_init(&runtime->buffer_mutex); > atomic_set(&runtime->buffer_accessing, 0); > > substream->runtime = runtime; > substream->private_data = pcm->private_data; > substream->ref_count = 1; > substream->f_flags = file->f_flags; > substream->pid = get_pid(task_pid(current)); > pstr->substream_opened++; > *rsubstream = substream; > return 0; > } > ``` > It would kzmalloc a new runtime. And initialize runtime simply. > If we write some data to the device. it would call snd_pcm_write or > snd_pcm_writev. and read some date from the device, it would call > snd_pcm_read or snd_pcm_readv. > Anyway, the four function would use data of runtime, but some data of > runtime is NULL not be initialized, see the code below: > ``` > static ssize_t snd_pcm_write(struct file *file, const char __user *buf, > size_t count, loff_t * offset) > { > struct snd_pcm_file *pcm_file; > struct snd_pcm_substream *substream; > struct snd_pcm_runtime *runtime; > snd_pcm_sframes_t result; > > pcm_file = file->private_data; > substream = pcm_file->substream; > if (PCM_RUNTIME_CHECK(substream)) > return -ENXIO; > runtime = substream->runtime; > if (runtime->status->state == SNDRV_PCM_STATE_OPEN || > runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED) > return -EBADFD; > if (!frame_aligned(runtime, count)) /////// [1] > return -EINVAL; > count = bytes_to_frames(runtime, count); /////// [2] > result = snd_pcm_lib_write(substream, buf, count); > if (result > 0) > result = frames_to_bytes(runtime, result); > return result; > } > ``` > [1] call frame_aligned to aligned. > ``` > static inline int frame_aligned(struct snd_pcm_runtime *runtime, ssize_t bytes) > { > return bytes % runtime->byte_align == 0; > } > ``` > but runtime->byte_align is NULL. > > [2] call bytes_to_frames. > ``` > static inline ssize_t frames_to_bytes(struct snd_pcm_runtime *runtime, > snd_pcm_sframes_t size) > { > return size * runtime->frame_bits / 8; > } > ``` > but runtime->frame_bits is NULL. > > ##reproduce it > [ 1189.305083][ T4656] divide error: 0000 [#1] PREEMPT SMP > [ 1189.305600][ T4656] CPU: 1 PID: 4656 Comm: snd_pcm_write Not > tainted 6.0.0-rc7 #16 > [ 1189.306157][ T4656] Hardware name: QEMU Standard PC (i440FX + PIIX, > 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 > [ 1189.306760][ T4656] RIP: 0010:snd_pcm_write+0x33/0xa0 > [ 1189.307155][ T4656] Code: 8b 38 48 85 ff 74 72 48 8b 9f c0 00 00 00 > 48 85 db 74 66 48 8b 83 00 01 00 00 f7 00 f7 ff ff ff 74 6b 48 89 d0 > 48 89 d1 31 d2 <48> f7 b3 91 > [ 1189.308553][ T4656] RSP: 0018:ffffc9000adc7e68 EFLAGS: 00010246 > [ 1189.309034][ T4656] RAX: 0000000000000000 RBX: ffff888048ec2000 > RCX: 0000000000000000 > [ 1189.309583][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 > RDI: ffff888046fc9c00 > [ 1189.310163][ T4656] RBP: 0000000000000000 R08: 0000000000000000 > R09: 0000000000020026 > [ 1189.310679][ T4656] R10: 0000000000000001 R11: 0000000000000000 > R12: 0000000000000000 > [ 1189.311226][ T4656] R13: ffffc9000adc7f08 R14: 0000000000000000 > R15: 0000000000000000 > [ 1189.311754][ T4656] FS: 00000000012d8880(0000) > GS:ffff88807ec00000(0000) knlGS:0000000000000000 > [ 1189.312350][ T4656] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 1189.312780][ T4656] CR2: 0000000020000000 CR3: 000000004b496000 > CR4: 00000000000006e0 > [ 1189.313234][ T4656] Call Trace: > [ 1189.313424][ T4656] > [ 1189.313597][ T4656] vfs_write+0xe6/0x4d0 > [ 1189.313836][ T4656] ksys_write+0x60/0xe0 > [ 1189.314071][ T4656] do_syscall_64+0x35/0xb0 > [ 1189.314324][ T4656] entry_SYSCALL_64_after_hwframe+0x63/0xcd > [ 1189.314734][ T4656] RIP: 0033:0x44dc3d > [ 1189.315007][ T4656] Code: 28 c3 e8 36 29 00 00 66 0f 1f 44 00 00 f3 > 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b > 4c 24 08 0f 05 <48> 3d 01 f8 > [ 1189.316338][ T4656] RSP: 002b:00007ffcbdf5ef38 EFLAGS: 00000246 > ORIG_RAX: 0000000000000001 > [ 1189.317012][ T4656] RAX: ffffffffffffffda RBX: 0000000000400530 > RCX: 000000000044dc3d > [ 1189.317693][ T4656] RDX: 0000000000000000 RSI: 0000000000000000 > RDI: 0000000000000003 > [ 1189.318172][ T4656] RBP: 00007ffcbdf5ef50 R08: 0000000082000000 > R09: 0000000000000000 > [ 1189.318648][ T4656] R10: 000000000000ffff R11: 0000000000000246 > R12: 00000000004030a0 > [ 1189.319182][ T4656] R13: 0000000000000000 R14: 00000000004c5018 > R15: 0000000000000000 The question is how the code passes the check before [1]: if (runtime->status->state == SNDRV_PCM_STATE_OPEN || runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED) return -EBADFD; The uninitialized state should have been with SNDRV_PCM_STATE_OPEN, and runtime->byte_align is set up at snd_pcm_hw_params() followed by snd_pcm-set_state() to chage the state to SNDRV_PCM_STATE_SETUP. Which kernel version are you testing? Takashi