April 2013 - Alsa-devel - mailman.alsa-project.org

[alsa-devel] [PATCH v5] ALSA: usb: Work around CM6631 sample rate change bug
by Torstein Hegge 03 Apr '13

03 Apr '13

The C-Media CM6631 USB receiver doesn't respond to changes in sample rate while the interface is active. The same behavior is observed in other UAC2 hardware like the VIA VT1731. Reset the interface after setting the sampling frequency on sample rate changes, to ensure that the sample rate set by snd_usb_init_sample_rate() is used. Otherwise, the device will try to use the sample rate of the previous stream, causing distorted sound on sample rate changes. The reset is performed for all UAC2 devices, as it should not affect a standards compliant device, but it is only necessary for C-Media CM6631, VIA VT1731 and possibly others. Failure to read sample rate from the device is not handled as an error in set_sample_rate_v2(), as (permanent or intermittent) failure to read sample rate isn't essential for a successful sample rate set. Signed-off-by: Torstein Hegge <hegge(a)resisty.net> --- Changes since v4: - Sample rate read failure is no longer fatal. Failure to read sample rate from the device is degraded from a fatal error to a warning message. The Schiit Bifrost has shown intermittent sample rate read failures, and this shouldn't be a reason to abort the initialization. - The reset is performed for all UAC2 devices. The number of devices affected by this issue seems to be larger than just the C-Media based devices, issues with the VIA VT1731 has been reported by Davor Herga to alsa-user [1]. The additional reset should not affect standards compliant devices and will hopefully improve the compatibility with future devices tested with the OS X UAC2 driver. This can cause problems for a theoretical device where sample rate read always fails, causing the reset to be performed every time the sample rate is set, *and* where repeated resets cause resume after pause to not resume properly, like the issues seen with CM6631 in the first iteration of this patch. [1] http://thread.gmane.org/gmane.linux.alsa.user/37312 Changes since v3: - Use given target rate instead of the new rate read from device when checking if a reset is needed. Some devices (at least Schiit Bifrost) doesn't report a reliable sample rate back right after setting a new rate. This appears to fix the issues with v3 of this patch with the Schiit, as reported by Chris Hermansen in http://thread.gmane.org/gmane.linux.alsa.user/36935/focus=37284 sound/usb/clock.c | 45 +++++++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 10 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 5e634a2..9e2703a 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -253,7 +253,7 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface, { struct usb_device *dev = chip->dev; unsigned char data[4]; - int err, crate; + int err, cur_rate, prev_rate; int clock = snd_usb_clock_find_source(chip, fmt->clock); if (clock < 0) @@ -266,6 +266,19 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface, return -ENXIO; } + err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR, + USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN, + UAC2_CS_CONTROL_SAM_FREQ << 8, + snd_usb_ctrl_intf(chip) | (clock << 8), + data, sizeof(data)); + if (err < 0) { + snd_printk(KERN_WARNING "%d:%d:%d: cannot get freq (v2)\n", + dev->devnum, iface, fmt->altsetting); + prev_rate = 0; + } else { + prev_rate = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24); + } + data[0] = rate; data[1] = rate >> 8; data[2] = rate >> 16; @@ -280,19 +293,31 @@ static int set_sample_rate_v2(struct snd_usb_audio *chip, int iface, return err; } - if ((err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR, - USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN, - UAC2_CS_CONTROL_SAM_FREQ << 8, - snd_usb_ctrl_intf(chip) | (clock << 8), - data, sizeof(data))) < 0) { + err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0), UAC2_CS_CUR, + USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_IN, + UAC2_CS_CONTROL_SAM_FREQ << 8, + snd_usb_ctrl_intf(chip) | (clock << 8), + data, sizeof(data)); + if (err < 0) { snd_printk(KERN_WARNING "%d:%d:%d: cannot get freq (v2)\n", dev->devnum, iface, fmt->altsetting); - return err; + cur_rate = 0; + } else { + cur_rate = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24); } - crate = data[0] | (data[1] << 8) | (data[2] << 16) | (data[3] << 24); - if (crate != rate) - snd_printd(KERN_WARNING "current rate %d is different from the runtime rate %d\n", crate, rate); + if (cur_rate != rate) { + snd_printd(KERN_WARNING + "current rate %d is different from the runtime rate %d\n", + cur_rate, rate); + } + + /* Some devices doesn't respond to sample rate changes while the + * interface is active. */ + if (rate != prev_rate) { + usb_set_interface(dev, iface, 0); + usb_set_interface(dev, iface, fmt->altsetting); + } return 0; } -- 1.7.10.4

5 8

Re: [alsa-devel] [PATCH 1/2] ASoC: Samsung: return error if drvdata is not set
by Mark Brown 03 Apr '13

03 Apr '13

On Tue, Apr 02, 2013 at 04:53:01PM +0530, Padmavathi Venna wrote: > From: Prathyush K <prathyush.k(a)samsung.com> > > This patch fixes a possible crash in case drvdata for the secondary > device is not set. Applied both, thanks.

1 0

[alsa-devel] [PATCH] Enable Realtek ALC671 Codec
by Rainer Koenig 03 Apr '13

03 Apr '13

Hi, working on a new mainboard generation with ALC671 codecs the first tests showed that the generic codec parser is just configuring the rear mic in for audio input, line-in and front-mic are missing. I tried to understand the code of patch_realtek.c and after compiling with CONFIG_SND_DEBUG I saw that this module is not used at all for the ALC671 codec because its device-ID was missing. So what I did is: - adding the device id and assigned the ALC662 patches for it. - Added the device id so that it enables 4 ports in alc662_parse_auto_config - changed the conditional in alc_subsystem_id because it looked so strange to me when I tried to understand what is happening. :-) Here is the patch: Signed-off-by: Rainer Koenig <Rainer.Koenig(a)ts.fujitsu.com> --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -1283,7 +1283,7 @@ static int alc_subsystem_id(struct hda_codec *codec, } ass = codec->subsystem_id & 0xffff; - if ((ass != codec->bus->pci->subsystem_device) && (ass & 1)) + if ((ass == codec->bus->pci->subsystem_device) && (ass & 1)) goto do_sku; /* invalid SSID, check the special NID pin defcfg instead */ @@ -6663,7 +6663,8 @@ static int alc662_parse_auto_config(struct hda_codec *codec) const hda_nid_t *ssids; if (codec->vendor_id == 0x10ec0272 || codec->vendor_id == 0x10ec0663 || - codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670) + codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670 || + codec->vendor_id == 0x10ec0671) ssids = alc663_ssids; else ssids = alc662_ssids; @@ -7115,6 +7116,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { { .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 }, { .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 }, { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 }, + { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 }, { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 }, { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 }, { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 }, -- Dipl.-Inf. (FH) Rainer Koenig Project Manager Linux Clients Dept. PDG WPS R&D SW OSE Fujitsu Technology Solutions Bürgermeister-Ullrich-Str. 100 86199 Augsburg Germany Telephone: +49-821-804-3321 Telefax: +49-821-804-2131 Mail: mailto:Rainer.Koenig@ts.fujitsu.com Internet ts.fujtsu.com Company Details ts.fujitsu.com/imprint.html

2 5

Re: [alsa-devel] [PATCH] sound: soc: tegra: do not provide PAUSE/RESUME in hardware info
by Lars-Peter Clausen 03 Apr '13

03 Apr '13

On 04/03/2013 11:19 AM, Laxman Dewangan wrote: > Tegra PCM driver uses the dmaengine based DMA driver and Tegra DMA > driver does not support the pause/resume functionality as hardware > does not support it. > > ALSA driver support the sw based pause/resume functionality if hardware > does not support it and in this case, hw driver should not provide > the hardware info with PAUSE/RESUME bit enable. > > Remmoving the SNDRV_PCM_INFO_PAUSE and SNDRV_PCM_INFO_RESUME from hardware > info and using the snd_dmaengine_pcm_trigger() for pcm_trigger callback. > > Signed-off-by: Laxman Dewangan <ldewangan(a)nvidia.com> Hm, I sent out the same patch just half an our or so ago. - Lars > --- > Lars reported that if driver/chip dma driver does not support the pause/resume > then need not to export this info through the hw capability and leave this > implementation to alsa driver. > > Making the change accordingly. > > sound/soc/tegra/tegra_pcm.c | 24 +----------------------- > 1 files changed, 1 insertions(+), 23 deletions(-) > > diff --git a/sound/soc/tegra/tegra_pcm.c b/sound/soc/tegra/tegra_pcm.c > index e67af0b..117cccc 100644 > --- a/sound/soc/tegra/tegra_pcm.c > +++ b/sound/soc/tegra/tegra_pcm.c > @@ -43,8 +43,6 @@ > static const struct snd_pcm_hardware tegra_pcm_hardware = { > .info = SNDRV_PCM_INFO_MMAP | > SNDRV_PCM_INFO_MMAP_VALID | > - SNDRV_PCM_INFO_PAUSE | > - SNDRV_PCM_INFO_RESUME | > SNDRV_PCM_INFO_INTERLEAVED, > .formats = SNDRV_PCM_FMTBIT_S16_LE, > .channels_min = 2, > @@ -121,26 +119,6 @@ static int tegra_pcm_hw_free(struct snd_pcm_substream *substream) > return 0; > } > > -static int tegra_pcm_trigger(struct snd_pcm_substream *substream, int cmd) > -{ > - switch (cmd) { > - case SNDRV_PCM_TRIGGER_START: > - case SNDRV_PCM_TRIGGER_RESUME: > - case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: > - return snd_dmaengine_pcm_trigger(substream, > - SNDRV_PCM_TRIGGER_START); > - > - case SNDRV_PCM_TRIGGER_STOP: > - case SNDRV_PCM_TRIGGER_SUSPEND: > - case SNDRV_PCM_TRIGGER_PAUSE_PUSH: > - return snd_dmaengine_pcm_trigger(substream, > - SNDRV_PCM_TRIGGER_STOP); > - default: > - return -EINVAL; > - } > - return 0; > -} > - > static int tegra_pcm_mmap(struct snd_pcm_substream *substream, > struct vm_area_struct *vma) > { > @@ -158,7 +136,7 @@ static struct snd_pcm_ops tegra_pcm_ops = { > .ioctl = snd_pcm_lib_ioctl, > .hw_params = tegra_pcm_hw_params, > .hw_free = tegra_pcm_hw_free, > - .trigger = tegra_pcm_trigger, > + .trigger = snd_dmaengine_pcm_trigger, > .pointer = snd_dmaengine_pcm_pointer, > .mmap = tegra_pcm_mmap, > };

1 0

[alsa-devel] [PATCH] salsa-lib: Add seq_midi_event.h
by Mihail Zenkov 03 Apr '13

03 Apr '13

--- salsa-lib-a55ce0c348cd16e7853dae11e8e0e1b5a101d884/configure.ac +++ salsa-lib-a55ce0c348cd16e7853dae11e8e0e1b5a101d884-1/configure.ac @@ -273,6 +273,7 @@ test "$sndseq" = "yes" && echo "#include \"seq_event.h\"" >> src/asoundlib.h test "$sndseq" = "yes" && echo "#include \"seq.h\"" >> src/asoundlib.h test "$sndseq" = "yes" && echo "#include \"seqmid.h\"" >> src/asoundlib.h +test "$sndseq" = "yes" && echo "#include \"seq_midi_event.h\"" >> src/asoundlib.h cat "$srcdir"/src/asoundlib-tail.h >> src/asoundlib.h echo "SALSA-Lib build configuration:" --- salsa-lib-a55ce0c348cd16e7853dae11e8e0e1b5a101d884/src/Makefile.am +++ salsa-lib-a55ce0c348cd16e7853dae11e8e0e1b5a101d884-1/src/Makefile.am @@ -60,7 +60,7 @@ endif if BUILD_SEQ alsainclude_HEADERS += \ - seq.h seq_event.h seqmid.h + seq.h seq_event.h seqmid.h seq_midi_event.h endif noinst_HEADERS = local.h --- /dev/null +++ salsa-lib-a55ce0c348cd16e7853dae11e8e0e1b5a101d884-1/src/seq_midi_event.h @@ -0,0 +1,78 @@ +#ifndef __ALSA_SEQ_MIDI_EVENT_H +#define __ALSA_SEQ_MIDI_EVENT_H + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * \defgroup MIDI_Event Sequencer event <-> MIDI byte stream coder + * \ingroup Sequencer + * Sequencer event <-> MIDI byte stream coder + * \{ + */ + +/** container for sequencer midi event parsers */ +typedef struct snd_midi_event { + size_t qlen; + size_t read; + int type; + unsigned char lastcmd; + unsigned char nostat; + size_t bufsize; + unsigned char *buf; +} snd_midi_event_t; + +__SALSA_EXPORT_FUNC +int snd_midi_event_new(size_t bufsize, snd_midi_event_t **rdev) +{ + return 0; +} +__SALSA_EXPORT_FUNC +int snd_midi_event_resize_buffer(snd_midi_event_t *dev, size_t bufsize) +{ + return 0; +} +__SALSA_EXPORT_FUNC +void snd_midi_event_free(snd_midi_event_t *dev) +{ +} +__SALSA_EXPORT_FUNC +void snd_midi_event_init(snd_midi_event_t *dev) +{ +} +__SALSA_EXPORT_FUNC +void snd_midi_event_reset_encode(snd_midi_event_t *dev) +{ +} +__SALSA_EXPORT_FUNC +void snd_midi_event_reset_decode(snd_midi_event_t *dev) +{ +} +__SALSA_EXPORT_FUNC +void snd_midi_event_no_status(snd_midi_event_t *dev, int on) +{ +} +__SALSA_EXPORT_FUNC +long snd_midi_event_encode(snd_midi_event_t *dev, const unsigned char *buf, long count, snd_seq_event_t *ev) +{ + return 0; +} +__SALSA_EXPORT_FUNC +int snd_midi_event_encode_byte(snd_midi_event_t *dev, int c, snd_seq_event_t *ev) +{ + return 0; +} +__SALSA_EXPORT_FUNC +long snd_midi_event_decode(snd_midi_event_t *dev, unsigned char *buf, long count, const snd_seq_event_t *ev) +{ + return 0; +} + + +#ifdef __cplusplus +} +#endif + +#endif /* __ALSA_SEQ_MIDI_EVENT_H */ +

2 6

[alsa-devel] [PATCH] salsa-lib: Fix error on jack compilation with salsa
by Mihail Zenkov 03 Apr '13

03 Apr '13

Fix error on jack compilation with salsa: /usr/include/alsa/ctl_macros.h:251:48: error: invalid conversion from 'void*' to 'snd_ctl_elem_id_t* {aka snd_ctl_elem_id*}' [-fpermissive] --- salsa-lib-a55ce0c348cd16e7853dae11e8e0e1b5a101d884/src/ctl_macros.h +++ salsa-lib-a55ce0c348cd16e7853dae11e8e0e1b5a101d884-1/src/ctl_macros.h @@ -248,7 +248,7 @@ unsigned int entries) { free(obj->pids); - obj->pids = calloc(entries, sizeof(*obj->pids)); + obj->pids = (snd_ctl_elem_id_t*)calloc(entries, sizeof(*obj->pids)); if (!obj->pids) { obj->space = 0; return -ENOMEM;

3 5

[alsa-devel] [PATCH 0/4] ALSA: Updates for the CA0132 codec
by Ian Minett 03 Apr '13

03 Apr '13

From: Ian Minett <ian_minett(a)creativelabs.com> Hi, This series contains the following updates to CA0132: 1: Add firmware loading for the SpeakerEQ DSP effect. 2: Improve DSP transfer timeout calculations. 3: Add stream and effect latency monitoring routines 4: Update hp unsolicited event handler to manage queued work. These were based on the latest sound.git, but please let me know if they should be against sound-unstable tree instead. Thanks very much, - Ian Signed-off-by: Ian Minett <ian_minett(a)creativelabs.com>

3 19

[alsa-devel] Audio capture on embedded system (via USB port)
by Israel Alejandro Arriaga Trejo 02 Apr '13

02 Apr '13

Hello, I am writing to kindly ask for assistance with ALSA on an embedded platform, in particular to record audio via a USB headset. The embedded platform I am currently using has analog inputs and outputs for audio (mic and headphone). So far I have been able to play and capture audio using the analog audio inputs/outputs with the commands aplay and arecord respectively from ALSA without any problems. However this is not the case when I am trying to use a USB headset via the USB port, at least while trying to record audio (playing audio is not a problem, it works perfectly fine for different rates and formats and the devices are recognized when I type aplay –l or arecord -l). However, when I try to capture audio, using the ALSA command line arecord as in: $ arecord –d 10 –r 16000 –f S16_LE –t wav –Dhw:1,0 test.wav even though the following message appears: $ Recording WAVE ‘test.wav’ : Signed 16 bit Little Endian, Rate 16000 Hz, Mono the application seems “to freeze”. In fact, the recording does not stop in the indicated 10 seconds, instead it continues “working” for a long period of time and creates the file test.wav which after is played it contains fragments of what actually was recorded via the microphone nonetheless, its content is unintelligible. In some cases the following error also appears: $ arecord: pcm_read:1617: read error: Input/Output error As mentioned previously this behavior is only observed during capture mode (while attempting to record using the microphone) since the playback mode using the USB headphone works properly. After browsing for a while I have found similar situations reported, however I have not been able to find a solution to my problem. I would highly appreciate for any hint that could help me to solve this issue. Best regards, Alejandro

2 1

Re: [alsa-devel] [PATCH 1/2] dmaengine: add const for name parameter
by Vinod Koul 02 Apr '13

02 Apr '13

On Fri, Mar 15, 2013 at 09:53:46AM +0100, Markus Pargmann wrote: > Hi, > > I already sent a nearly identical patch: > https://patchwork.kernel.org/patch/2179321/ I applied that one a while ago so Markus can you check my tree and see if anything is remaining, looks most of cases are covered > > Regards, > > Markus > > On Fri, Mar 15, 2013 at 11:36:40AM +0800, Shawn Guo wrote: > > Mark name parameter of generic device tree helpers as const, as it > > shouldn't be changed anyway. > > > > Signed-off-by: Shawn Guo <shawn.guo(a)linaro.org> > > --- > > drivers/dma/dmaengine.c | 2 +- > > drivers/dma/of-dma.c | 6 +++--- > > include/linux/dmaengine.h | 7 ++++--- > > include/linux/of_dma.h | 2 +- > > 4 files changed, 9 insertions(+), 8 deletions(-) > > > > diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c > > index b2728d6..2cbfefe 100644 > > --- a/drivers/dma/dmaengine.c > > +++ b/drivers/dma/dmaengine.c > > @@ -555,7 +555,7 @@ EXPORT_SYMBOL_GPL(__dma_request_channel); > > * @dev: pointer to client device structure > > * @name: slave channel name > > */ > > -struct dma_chan *dma_request_slave_channel(struct device *dev, char *name) > > +struct dma_chan *dma_request_slave_channel(struct device *dev, const char *name) > > { > > /* If device-tree is present get slave info from here */ > > if (dev->of_node) > > diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c > > index 69d04d2..6036cd0 100644 > > --- a/drivers/dma/of-dma.c > > +++ b/drivers/dma/of-dma.c > > @@ -172,8 +172,8 @@ EXPORT_SYMBOL_GPL(of_dma_controller_free); > > * specifiers, matches the name provided. Returns 0 if the name matches and > > * a valid pointer to the DMA specifier is found. Otherwise returns -ENODEV. > > */ > > -static int of_dma_match_channel(struct device_node *np, char *name, int index, > > - struct of_phandle_args *dma_spec) > > +static int of_dma_match_channel(struct device_node *np, const char *name, > > + int index, struct of_phandle_args *dma_spec) > > { > > const char *s; > > > > @@ -198,7 +198,7 @@ static int of_dma_match_channel(struct device_node *np, char *name, int index, > > * Returns pointer to appropriate dma channel on success or NULL on error. > > */ > > struct dma_chan *of_dma_request_slave_channel(struct device_node *np, > > - char *name) > > + const char *name) > > { > > struct of_phandle_args dma_spec; > > struct of_dma *ofdma; > > diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h > > index 91ac8da..68b4252 100644 > > --- a/include/linux/dmaengine.h > > +++ b/include/linux/dmaengine.h > > @@ -968,7 +968,8 @@ enum dma_status dma_sync_wait(struct dma_chan *chan, dma_cookie_t cookie); > > enum dma_status dma_wait_for_async_tx(struct dma_async_tx_descriptor *tx); > > void dma_issue_pending_all(void); > > struct dma_chan *__dma_request_channel(dma_cap_mask_t *mask, dma_filter_fn fn, void *fn_param); > > -struct dma_chan *dma_request_slave_channel(struct device *dev, char *name); > > +struct dma_chan *dma_request_slave_channel(struct device *dev, > > + const char *name); > > void dma_release_channel(struct dma_chan *chan); > > #else > > static inline enum dma_status dma_wait_for_async_tx(struct dma_async_tx_descriptor *tx) > > @@ -984,7 +985,7 @@ static inline struct dma_chan *__dma_request_channel(dma_cap_mask_t *mask, > > return NULL; > > } > > static inline struct dma_chan *dma_request_slave_channel(struct device *dev, > > - char *name) > > + const char *name) > > { > > return NULL; > > } > > @@ -1007,7 +1008,7 @@ struct dma_chan *net_dma_find_channel(void); > > static inline struct dma_chan > > *__dma_request_slave_channel_compat(dma_cap_mask_t *mask, dma_filter_fn fn, > > void *fn_param, struct device *dev, > > - char *name) > > + const char *name) > > { > > struct dma_chan *chan; > > > > diff --git a/include/linux/of_dma.h b/include/linux/of_dma.h > > index d15073e..0c4a82e 100644 > > --- a/include/linux/of_dma.h > > +++ b/include/linux/of_dma.h > > @@ -40,7 +40,7 @@ extern int of_dma_controller_register(struct device_node *np, > > void *data); > > extern int of_dma_controller_free(struct device_node *np); > > extern struct dma_chan *of_dma_request_slave_channel(struct device_node *np, > > - char *name); > > + const char *name); > > extern struct dma_chan *of_dma_simple_xlate(struct of_phandle_args *dma_spec, > > struct of_dma *ofdma); > > #else > > -- > > 1.7.9.5 > > > > > > > > -- > Pengutronix e.K. | | > Industrial Linux Solutions | http://www.pengutronix.de/ | > Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | > Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |

4 6

[alsa-devel] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010, IP: [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0
by Tommi Rantala 02 Apr '13

02 Apr '13

Hello, Saw this while fuzzing with trinity in a qemu virtual machine: [6026] Random reseed: 625996896 [watchdog] 7640111 iterations. [F:6650299 S:989808] [6026] Random reseed: 472197910 [ 459.365417] misc rfkill: uevent: unknown action-string [ 459.521953] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 [ 459.522027] IP: [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 [ 459.522027] PGD 52deb067 PUD 50bbc067 PMD 0 [ 459.522027] Oops: 0000 [#1] SMP [ 459.522027] CPU 0 [ 459.522027] Pid: 7781, comm: trinity-child53 Tainted: G W 3.9.0-rc1+ #103 Bochs Bochs [ 459.522027] RIP: 0010:[<ffffffff819865fb>] [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 [ 459.522027] RSP: 0018:ffff880065455a88 EFLAGS: 00010202 [ 459.522027] RAX: 0000000000000001 RBX: ffff8800508e1760 RCX: 0000000000000000 [ 459.522027] RDX: ffff880065455b57 RSI: ffff880065455ad8 RDI: ffff8800599ceba0 [ 459.522027] RBP: ffff880065455a88 R08: 0000000000000010 R09: 0000000000000001 [ 459.522027] R10: ffff8800461f5630 R11: 0000000000000000 R12: ffff88007a470960 [ 459.522027] R13: ffff88007a43b980 R14: ffff88007a470000 R15: ffff88007a43b900 [ 459.522027] FS: 00007f9c07c94700(0000) GS:ffff88007f800000(0000) knlGS:0000000000000000 [ 459.522027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 459.522027] CR2: 0000000000000010 CR3: 0000000060ee2000 CR4: 00000000000006f0 [ 459.522027] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 459.522027] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 459.522027] Process trinity-child53 (pid: 7781, threadinfo ffff880065454000, task ffff8800797c2290) [ 459.522027] Stack: [ 459.522027] ffff880065455b88 ffffffff819a3f7e ffff880065455ab8 ffff8800599ceba0 [ 459.522027] ffff8800508e1220 ffff8800508e1200 ffff880065455b48 ffffffff8136eafc [ 459.522027] ffff880065455ae8 ffffffff81091198 ffff88007cc01600 ffff8800508e1200 [ 459.522027] Call Trace: [ 459.522027] [<ffffffff819a3f7e>] snd_mixer_oss_proc_write+0x1ee/0x250 [ 459.522027] [<ffffffff8136eafc>] ? debug_check_no_obj_freed+0x17c/0x230 [ 459.522027] [<ffffffff81091198>] ? kmemcheck_shadow_lookup+0x28/0x80 [ 459.522027] [<ffffffff81985a38>] ? snd_info_entry_release+0x48/0xd0 [ 459.522027] [<ffffffff81199c0c>] ? kfree+0x1ac/0x1e0 [ 459.522027] [<ffffffff81985a50>] snd_info_entry_release+0x60/0xd0 [ 459.522027] [<ffffffff81211022>] proc_reg_release+0x132/0x180 [ 459.522027] [<ffffffff819859f0>] ? snd_info_entry_llseek+0x100/0x100 [ 459.522027] [<ffffffff811a807a>] __fput+0x11a/0x220 [ 459.522027] [<ffffffff811a8189>] ____fput+0x9/0x10 [ 459.522027] [<ffffffff810bcbbe>] task_work_run+0x9e/0xc0 [ 459.522027] [<ffffffff8109d85c>] do_exit+0x3ac/0xad0 [ 459.522027] [<ffffffff810afc29>] ? get_signal_to_deliver+0xf9/0x810 [ 459.522027] [<ffffffff8109e044>] do_group_exit+0x84/0xd0 [ 459.522027] [<ffffffff810b0269>] get_signal_to_deliver+0x739/0x810 [ 459.522027] [<ffffffff810583b2>] do_signal+0x52/0x570 [ 459.522027] [<ffffffff810cbaf3>] ? finish_task_switch+0x43/0x120 [ 459.522027] [<ffffffff810f3366>] ? trace_hardirqs_on_caller+0x16/0x1f0 [ 459.522027] [<ffffffff810f354d>] ? trace_hardirqs_on+0xd/0x10 [ 459.522027] [<ffffffff81fad85b>] ? _raw_spin_unlock_irq+0x2b/0x40 [ 459.522027] [<ffffffff810cbb30>] ? finish_task_switch+0x80/0x120 [ 459.522027] [<ffffffff810cbaf3>] ? finish_task_switch+0x43/0x120 [ 459.522027] [<ffffffff810588f7>] do_notify_resume+0x27/0x70 [ 459.522027] [<ffffffff813663fe>] ? trace_hardirqs_on_thunk+0x3a/0x3f [ 459.522027] [<ffffffff81faf0a2>] int_signal+0x12/0x17 [ 459.522027] Code: 00 8b 4f 14 85 c9 0f 85 cf 00 00 00 44 8b 5f 18 45 85 db 74 6b e9 c1 00 00 00 66 0f 1f 44 00 00 8b 47 08 4c 8b 07 89 c1 83 c0 01 <41> 0f b6 0c 08 89 47 08 44 0f be c1 41 83 f8 0a 75 2b 39 47 0c [ 459.522027] RIP [<ffffffff819865fb>] snd_info_get_line+0x3b/0xf0 [ 459.522027] RSP <ffff880065455a88> [ 459.522027] CR2: 0000000000000010 [ 459.652998] ---[ end trace a9ded493128a1bce ]--- [ 459.654880] Fixing recursive fault but reboot is needed! [6026] Random reseed: 807260652 [watchdog] pid 8469 hasn't made progress in 30 seconds! (last:2725563185 now:2725563215 diff:30). Stuck in syscall 70:msgrcv. Sending SIGKILL. [watchdog] 7677069 iterations. [F:6682605 S:994461] [6026] Random reseed: 575363686 [ 461.032969] misc ashmem: uevent: unknown action-string [6026] Random reseed: 1095114151 [6026] Regenerating random pages, fd's etc. Tommi

2 1