On Tue, Mar 28, 2023 at 10:36 AM Jens Axboe <axboe@xxxxxxxxx> wrote: > > @@ -3516,23 +3516,28 @@ static void __user **snd_map_bufs(struct snd_pcm_runtime *runtime, > struct iov_iter *iter, > snd_pcm_uframes_t *frames, int max_segs) > { > + int nr_segs = iovec_nr_user_vecs(iter); This has a WARN_ON_ONCE() for !user_backed, but then.. > void __user **bufs; > + struct iovec iov; > unsigned long i; > > if (!iter->user_backed) > return ERR_PTR(-EFAULT); here the code tries to deal with it. So I think the two should probably be switched around. Linus